MalwareBazaar Database

This page shows some basic information the YARA rule Tool_FakeInstaller_1 including corresponding malware samples.

Database Entry

YARA Rule:Tool_FakeInstaller_1
Create hunting rule
Author:Nikos 'n0t' Totosis
Description:Detects fake installers that extract single-byte XOR - encrypted payloads from PE resources with IDs 1, 2.
Firstseen:2026-10-01 10:17:34 UTC
Lastseen:2026-11-10 03:25:37 UTC
Sightings:2

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter