MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15af5bbf3c8d5e5db41fd7c3d722e8b247b40f2da747d5c334f7fd80b715a649. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CrossRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15af5bbf3c8d5e5db41fd7c3d722e8b247b40f2da747d5c334f7fd80b715a649
SHA3-384 hash: a12a11796de450753f94b14bce2dce5aa442256ee60ae49885b9f9a9ec34e5e05b64878759d6afd197ce8603caffec08
SHA1 hash: b23e070dadc997759574d5ee92c7753b84968f50
MD5 hash: 85b794e080d83a91e904b97769e1e770
humanhash: vermont-bacon-coffee-whiskey
File name:hmar6.jar
Download: download sample
Signature CrossRAT
Create hunting rule
File size:222'543 bytes
First seen:2022-03-30 11:45:11 UTC
Last seen:Never
File type:Java file jar
MIME type:application/zip
ssdeep 6144:fHlBHxlxKspNWClCc+jp72G0gZ/ZJSEOaqLFjt+WV:fFtxlaClCc+jp72G0shJ2aq5jUw
TLSH T16B240278FD93E0B0F407D034E190D926622D0249A1898A5B9EE76A53DE20CD52F1FADF
Reporter katsuragicsl
Tags:crossrat jar

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CrossRAT.jar
Verdict:
Malicious activity
Analysis date:
2022-01-11 15:42:11 UTC
Tags:
fuck
Link:
https://app.any.run/tasks/c205805f-f543-43cd-abea-b95a10fea7a9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/259654/
Detection(s):
SecuriteInfo.com.Trojan.Java.Agent.ALD.18359.16446.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.25150.32268.19007.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.CrossRat.1.20774.9694.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.22675.26978.13101.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGB.25203.8505.22437.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Java.Trojan.GenericGBA.5603.21983.22584.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug crat crossrat obfuscated rat rundll32.exe
Link:
https://www.filescan.io/uploads/624442fd9253b276b7a7172b/reports/f9fb1d67-ddc3-4a46-98b5-d36971b1d14e/overview
Result
Threat name:
CrossRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/967539
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15af5bbf3c8d5e5db41fd7c3d722e8b247b40f2da747d5c334f7fd80b715a649/
Threat name:
ByteCode-JAVA.Backdoor.CrossRAT
Create hunting rule
Status:
Malicious
First seen:
2018-01-23 22:34:04 UTC
File Type:
Binary (Archive)
Extracted files:
73
AV detection:
28 of 42 (66.67%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/220330-nxaffsbhc5/
Behaviour
Modifies registry key
Suspicious use of WriteProcessMemory
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/15af5bbf3c8d5e5db41fd7c3d722e8b247b40f2da747d5c334f7fd80b715a649

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://objective-see.com/blog/blog_0x28.html
Cape
Cape
https://www.capesandbox.com/analysis/259654/

Comments