MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TigerRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
SHA3-384 hash: 53a5986d72cad7ecc3ecd35bd953140eadaa26270115b601ee974ffa2f54dc7c025ef5da994dc4c1b79066db11e4bebe
SHA1 hash: 00331e5f972a98755811c02ec47301336a824a34
MD5 hash: 4df757390adf71abdd084d3e9718c153
humanhash: mike-venus-florida-purple
File name:1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
Download: download sample
Signature TigerRAT
Create hunting rule
File size:467'968 bytes
First seen:2022-09-07 20:49:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 47d612847dc9f9ce71631333113d4d39 (1 x TigerRAT)
ssdeep 6144:kDZSfTWQ2Rsgc4iqgjjjjjUwW7D4cs/5ZRBAD6rZbdQc8XAXz40R5SVt1WskvLOl:QZS7DbW705ZTu6Vd0wXk0RwL1OO+gZ
Threatray 1'142 similar samples on MalwareBazaar
TLSH T11EA46A6E12E82AE5D0608AB46EB25694F7636C737B60960BE7780CB53D1B3903DF4713
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 60d09ebe969ecc70 (1 x TigerRAT)
Reporter Arkbird_SOLG
Tags:apt38 exe TigerRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
438
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
Verdict:
No threats detected
Analysis date:
2022-09-07 20:52:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c20f9878-76a8-457e-b84d-b7e5fbb53d66

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/308591/
Detection(s):
SecuriteInfo.com.Trojan.Siggen13.10565.25801.6697.UNOFFICIAL
Create hunting rule

Win.Backdoor.TigerRAT-9964295-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a process with a hidden window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/36981/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/63190439d94ccae410838a73/reports/6a320fe8-7b6a-4e3d-8b89-163d5cb7d814/overview
Malware family:
TigerRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70c437bc-cd6a-453a-a26a-646e72728c2c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/810884
Signature
Multi AV Scanner detection for submitted file
Sigma detected: Rundll32 Without Parameters
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392/
Threat name:
Win64.Backdoor.Sntukore
Create hunting rule
Status:
Malicious
First seen:
2021-07-01 01:10:00 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6g47lv3zv7hdquhfyf2f7dnxaowkhhwksrb2m6hr2xgmyxgeoja._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
0193bd8bcbce9765dbecb288d46286bdc134261e4bff1f3c1f772d34fe4ec695
TigerRAT
0996a8e5ec1a41645309e2ca395d3a6b766a7c52784c974c776f258c1b25a76c
TigerRAT
11be3a269a06b23158afb18561fb7c059f3105d1d37ddfec980899e296dc267e
TigerRAT
2874c64342b0deaca1f44aac74b0663926af3d039f0eebe5b20c0788ed6df4b4
TigerRAT
f13aff9e1192c081c012f974b29bf60487385eed644d506d7f82b3538c2b035f
TigerRAT
f40d387631ddb0db70128e72239d0cae7a22b2135c0ec0d540e018aa727d4c8e
TigerRAT
+ 1'132 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220908-fws76sdgc4/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
MD5 hash:
4df757390adf71abdd084d3e9718c153
SHA1 hash:
00331e5f972a98755811c02ec47301336a824a34
Detections:
win_tiger_rat_auto
Create hunting rule
Link:
https://www.unpac.me/results/b6c18dc9-e8a9-4de3-afe3-cd2d89958755/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Andariel
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:win_tiger_rat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.tiger_rat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html
Cape
Cape
https://www.capesandbox.com/analysis/308591/

Comments