MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f7e4f07f39a6c32babc1cff1c7df1e12f6dc330326c6d2f4c8d880c41d2a15b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f7e4f07f39a6c32babc1cff1c7df1e12f6dc330326c6d2f4c8d880c41d2a15b
SHA3-384 hash: 3c86baba802d583c0864f711d8568c7c632ad3af82c3365d0c37e20a14c1113cfd4519c537262f8e8a4c658db61b3e49
SHA1 hash: 868756a762f7ddf961f3b1ea726e773845cae6c9
MD5 hash: 7e38ff0cca84277fee9eb24520f7b7c1
humanhash: california-mountain-pasta-connecticut
File name:HALKBANK1.exe
Download: download sample
File size:747'520 bytes
First seen:2022-04-15 06:56:36 UTC
Last seen:2022-04-15 08:20:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'067 x AgentTesla, 20'019 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 12288:WN1OkBVzGH3TJsFXhrK+QsvVhHVS00DQe4haJFfC+Gyw9EhKHCPibVjV6yOVJZnJ:yIkBlGlsFXB8s/pRe4EJ5HGlaIy810RJ
Threatray 667 similar samples on MalwareBazaar
TLSH T160F4231122AAA72BD9FDEBF758E5746003B15257BC10F3884EC534DB15B2B00AE94FA7
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.3% (.SCR) Windows screen saver (13101/52/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 04d4ccd8c4ccd400 (10 x AgentTesla, 6 x SnakeKeylogger, 4 x Loki)
Reporter abuse_ch
Tags:exe geo Halkbank TUR

Intelligence

File Origin
# of uploads :
2
# of downloads :
319
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
HALKBANK1.exe
Verdict:
Suspicious activity
Analysis date:
2022-04-15 07:45:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/20a1759d-990f-468c-ba53-2b96c4b8b64d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/263926/
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.1126.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62591746482f2f41cab367a8/reports/7f87ee84-cbf8-4c6d-b124-d707a7cdd8fd/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/1888f2cb-bff9-4c70-a438-c50689e4ea10
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/977304
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f7e4f07f39a6c32babc1cff1c7df1e12f6dc330326c6d2f4c8d880c41d2a15b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-15 06:57:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
12
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d57e6b7ttjwdfov4dt7ry7pr4exw3qzqgjwg2l2mrweayqosufnq._file
Verdict:
malicious
Similar samples:
22806dee92ca27c19c77033af2317723079fb0013a5eb864ac011075e81028fd
546af5248d01e7d2b994944e9dd69ce8de7259515b898f1b8d1f6d811c62b1cc
60ad58a938752fff5d6e9442d529fe21b5ecca6166ba78f68ec5c810f6285649
7d38cedb59886341a3cd69ee15d266aa9c0b37717e44ff30ea76c156c6e6c1af
97b8cbbf8c6ad0938c1571aec398c7ec3f854ae232a09a205309b5e8ead7dbda
ddd66a333bedd6a64fa0f7b2daf36a0d9d738957e57af23aa130724e36aeb238
fca101958a7bcbf8b717517055f150dad83aa482c00165f67312c613f8b450d3
fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a
+ 657 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220415-hqx1aaaehl/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
90ade9f40ab9c852bf1eb99d9390c95b1113d5b8a3f3b231bd3c7e8ac3537fe1
MD5 hash:
0123c9a82f5ea8d5b3acf7701cbaa9ec
SHA1 hash:
e96f07d23d3277be9b036c2cc69a8de263626dc0
Link:
https://www.unpac.me/results/5a579a57-b928-4052-b001-bc6b18516e03/
SH256 hash:
457261e0ade3e1779cbc52060d2a0e05442450956df0d656e3673c0963cd02b2
MD5 hash:
d0e5bcc9d1d57e965e0d5985c3ba2bdc
SHA1 hash:
32bd74ce8f7230eed048665b8175576685aac249
Link:
https://www.unpac.me/results/5a579a57-b928-4052-b001-bc6b18516e03/
SH256 hash:
1f7e4f07f39a6c32babc1cff1c7df1e12f6dc330326c6d2f4c8d880c41d2a15b
MD5 hash:
7e38ff0cca84277fee9eb24520f7b7c1
SHA1 hash:
868756a762f7ddf961f3b1ea726e773845cae6c9
Link:
https://www.unpac.me/results/5a579a57-b928-4052-b001-bc6b18516e03/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/1f7e4f07f39a6c32babc1cff1c7df1e12f6dc330326c6d2f4c8d880c41d2a15b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:t0_1
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263926/

Comments