MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4692d9ff78746e3320d8f60e481f207c98898f56daa401f1f96297e9afcca74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4692d9ff78746e3320d8f60e481f207c98898f56daa401f1f96297e9afcca74
SHA3-384 hash: 901f742a808b5b8490244585ae81f0d66ac5a69826ae917c97e6f577b64106391b053be03a6d84f4b36c87db4685bf5b
SHA1 hash: 644c20b502092c86119a04fad4757fc2d64038e8
MD5 hash: 1d9cf112123e789922d5a2b287173532
humanhash: wyoming-equal-purple-apart
File name:1d9cf112123e789922d5a2b287173532
Download: download sample
File size:152'576 bytes
First seen:2022-04-08 06:54:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:mDp/yLg05RihFAPOjn4EZgFcAHsQsrFYB434t6aFz8WWV:m47ShZQc1rFYu+Zy
Threatray 113 similar samples on MalwareBazaar
TLSH T127E36D243DFB501AF1B3AF759AE8B5D689AFB3633A07945E106203470B13B81DED153A
Reporter zbetcheckin
Tags:32 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1d9cf112123e789922d5a2b287173532
Verdict:
No threats detected
Analysis date:
2022-04-08 07:12:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/87906e39-470b-4262-bfd3-f15099247f0d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/261899/
Detection(s):
Win.Packed.Pwsx-9918173-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/624fdc18d53a7479dad848e4/reports/458b1dd3-dea6-4174-80f4-b8e60dd70204/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/938203a6-29ec-42b2-9ac2-d4f97fc13b26
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/972908
Signature
.NET source code contains very large array initializations
Antivirus / Scanner detection for submitted sample
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4692d9ff78746e3320d8f60e481f207c98898f56daa401f1f96297e9afcca74/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-04-05 06:36:20 UTC
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
4d70552b360f16a8af152775ee674101074af65bbc6593291fa40ba6b85d1ee3
517ba2a65a703b898d88ea8379cebe3ce9cfaa5b728fc9fb893aa6c75349e589
74a69d491cf1b7c8e2c24c862c0aea24f33f8ed6bec8f2bfab0ec4a4281fd892
953c917ea98a8b9eff67f260709fb55980c614c2d87dbb399c77a3ec682fe00e
d61c2357e0c8c9f31ec671fbd0657ce5463a807ff5f9136e8859578f6c42e47b
ed1cbf6a5d93c943d06ae292fb5a99984f555a15fdce4ae4bc12295f89cbcc59
+ 103 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220408-hn73gaheg4/
Unpacked files
SH256 hash:
f4692d9ff78746e3320d8f60e481f207c98898f56daa401f1f96297e9afcca74
MD5 hash:
1d9cf112123e789922d5a2b287173532
SHA1 hash:
644c20b502092c86119a04fad4757fc2d64038e8
Link:
https://www.unpac.me/results/548312c0-9d99-4b6c-accb-1fab3b99df14/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/f4692d9ff78746e3320d8f60e481f207c98898f56daa401f1f96297e9afcca74

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f4692d9ff78746e3320d8f60e481f207c98898f56daa401f1f96297e9afcca74

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2136799/
Cape
Cape
https://www.capesandbox.com/analysis/261899/

Comments


Avatar
zbet commented on 2022-04-08 06:54:04 UTC

url : hxxp://107.189.6.214/CzKc18o2/Trajected.exe