MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9cb1efeadb768deb9b9fb669249b1b7bc242ee6fd3462b326ffcdeea42a657b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AARRat


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9cb1efeadb768deb9b9fb669249b1b7bc242ee6fd3462b326ffcdeea42a657b
SHA3-384 hash: 01d04b1bd14fff5b48a4ef652f1c67e1e004d79e338c30c71240ad7cf1a14b6cd735fe4a2df0bd147c30016405d1feb2
SHA1 hash: 55b8fbc9dd723f558d9f3e34b1fa339a8c8b2ad4
MD5 hash: a33c55d1565cf51b85888459090b1061
humanhash: low-equal-fix-jig
File name:f9cb1efeadb768deb9b9fb669249b1b7bc242ee6fd3462b326ffcdeea42a657b
Download: download sample
Signature AARRat
Create hunting rule
File size:167'424 bytes
First seen:2020-06-10 11:33:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:ZgYu3EcVaILaTEDzgMQIEUOSVB3+LcbNSmkpe4J+zSqm:W9z2InOSj+uEmU+D
Threatray 51 similar samples on MalwareBazaar
TLSH C2F3CF2632884776C734A8B8E0FBB22183F02DDB93729945FF8C31991D673939D6D549
Reporter JAMESWT_WT
Tags:AARRat

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Mdrop-7173599-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 20:39:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
0f6ab91e876a548f6434c6be14fa607768a597430b226d586cf428da94ab931c
AARRat
1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9
AARRat
290452bb8eb4dfcc3cfb1590c8fb1b44427a3c9f0439ad5855e35bc39537a3a3
AARRat
4e890d4e6329b4ea3bc61d458e727a81cdf9358d6b5bedbd290aa85ed7a189d1
AARRat
4f51da0a7034a3b491bf21d56896d2cc97f5f240911abfaeacfe73d80bd84a34
AARRat
59aaaca777876da03ce73437def6b4be378bd680e7eecbfd60f70fe058fb5f1b
AARRat
6a277e9e2f6049fb8009d2f139a217b53da1448d7ca5c4da751336bd00d44ae1
AARRat
b295967168e9fc2f06437a12689122301171650aa213095bda2c1260d8f3c607
AARRat
e131a045dc4874ee4eed8e75af0faeecaf86a80e18f13b9845a8b6f57686beec
AARRat
eedded196860d1ef5a143268a85bc3951af23e55da8c12b8b1b58b42b9f443f1
AARRat
+ 41 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-xzt3yrvyye/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RAT_AAR
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects AAR RAT
Reference:http://malwareconfig.com/stats/AAR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments