🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4546bf50e116c0cc49d206b2be2815f2724944ba7aa0b305837f90dbddd863c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4546bf50e116c0cc49d206b2be2815f2724944ba7aa0b305837f90dbddd863c7
SHA3-384 hash: 002bcb722d5110b35cbd8836805960ae61cabf577353349a703a0e86b4664310e6ff3ea0b87d32c7b38c5eae28fd57bf
SHA1 hash: 881514ba7df186ec16ac03d279cb0c1df8afb948
MD5 hash: 297a331c90ab8923b7d44a8c2e59f7b8
humanhash: blossom-hot-oven-black
File name:297a331c90ab8923b7d44a8c2e59f7b8
Download: download sample
File size:303'104 bytes
First seen:2020-11-30 00:29:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'297 x AgentTesla, 20'717 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 3072:aDE3kJhakQzwFHmtg3OP2mPJrDiTxvYjw7qiN8xXIT4FHH2WdyHS29h5ueYQ:lkPakQUFHmtgeHJrDiTxwjQ4ITkHwB
Threatray 349 similar samples on MalwareBazaar
TLSH C7545A85B20A3304DA96F63CC0264B4036CB5DED53BBF5078568F995B27ADCAF31A706
Reporter c3rb3ru5d3d53c2
Tags:actor:transparenttribe


Avatar
c3rb3ru5d3d53c
Today our researchers have found #Exe impalnt which belongs to #TranSparentTribe #APT group
ITW:297a331c90ab8923b7d44a8c2e59f7b8
filename:Resume.exe
C2:209.127.16.126:4768
funny pdb path ==>
g:\imra-new\fhrnthivesa\fhrnthivesa\obj\Debug\fhrnthivesa.pdb

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/105986/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Launching a process
Moving a recently created file
Deleting a recently created file
Creating a process from a recently created file
Unauthorized injection to a recently created process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4546bf50e116c0cc49d206b2be2815f2724944ba7aa0b305837f90dbddd863c7/
Threat name:
ByteCode-MSIL.Backdoor.CrimsonRAT
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 04:21:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
2d725c799e8787ef98e26cb025144cbe405aef31bc4ddd2011c80c09efa87400
466de5558ccea92e0395a1e775b8625f7818d3f70b8f09143935e0dc9e15a0e9
46cad0e0ca3b2d6d9d3ce691ca2887b18abc80acf0e81799fbb290cce104c8eb
5176a48afec98e65c46b54977d76a78f20d8bd4333ca64285495a05862d6749b
567b82c892f10a5cc6d0286c5777e7462cec7182eba81db7dd7de53d1e8d3274
7de78f7c806f828ef071a103b7be87636414635e008ea2463bf33077a466140a
9384296bb6fa6159840f84440da915fc9e93a94d476a28a33265318c0b4d03a2
981c7acea454b7328dd9ab2e2ff7b20df0b0b3e964f481f9776a4dc76bc9ac16
b9446d663f2aef34efdb579ae02e62923b5c3bc02b9d0fe537f5974ae439a422
c9cdd5a5b0701a4d311e0264f5bcec49fa500dde81ff8dbaa081be032b0c0446
+ 339 additional samples on MalwareBazaar
Result
Malware family:
crimsonrat
Create hunting rule
Score:
  10/10
Tags:
family:crimsonrat rat
Link:
https://tria.ge/reports/201130-h5xxt4rl3a/
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
CrimsonRAT Main Payload
CrimsonRat
Unpacked files
SH256 hash:
4546bf50e116c0cc49d206b2be2815f2724944ba7aa0b305837f90dbddd863c7
MD5 hash:
297a331c90ab8923b7d44a8c2e59f7b8
SHA1 hash:
881514ba7df186ec16ac03d279cb0c1df8afb948
Link:
https://www.unpac.me/results/43dac2ca-dd73-440b-afc6-b6145eb0fbe5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4546bf50e116c0cc49d206b2be2815f2724944ba7aa0b305837f90dbddd863c7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/ShadowChasing1/status/1328003172158238720
  
Dropping
CrimsonRAT
Cape
Cape
https://www.capesandbox.com/analysis/105986/

Comments