MalwareBazaar Database

This page shows some basic information the YARA rule Tool_FakeInstaller_2 including corresponding malware samples.

Database Entry

YARA Rule:Tool_FakeInstaller_2
Create hunting rule
Author:Nikos 'n0t' Totosis
Description:Detects fake installers that decrypt RC4-encrypted payloads stored in PE resources with IDs 100, 101.
Firstseen:2026-07-07 08:42:58 UTC
Lastseen:2026-08-06 14:20:10 UTC
Sightings:2

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter