MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 077939298093e122bcec38dce3ca860b155f569a0ba2f9118cfcdd47ba7cd338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	077939298093e122bcec38dce3ca860b155f569a0ba2f9118cfcdd47ba7cd338
SHA3-384 hash:	e0d887e179537376318706e65a75bf58c5f160c27f5f954fa323e9490137f5e8f24fb35450b793da4987beeb6a285f6f
SHA1 hash:	758304040b3cef0a865fdfd7c8bca180d63c07a8
MD5 hash:	d5ba970e6b88cc26295d7ac9fbbaf3ed
humanhash:	sad-bacon-sink-sink
File name:	Order25072020.doc
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	215'552 bytes
First seen:	2020-07-25 07:51:58 UTC
Last seen:	2020-07-25 08:57:49 UTC
File type:	doc
MIME type:	application/msword
ssdeep	3072:TEdBE/5Vmj7SnNhtzqDM9Ji70W0T7QjnuYgTv2CTiPVMQalYd41do9zhUkG5I+0K:LnMgJigN7QzuY7CEe641iSkwGQ
TLSH	3C240144B089DA2EE15080741EDBE6E9B329FC509F17C39F72587B3EBCBA3609625740
Reporter	abuse_ch
Tags:	AsyncRAT doc nVpn RAT

abuse_ch

Malspam distributing AsyncRAT:

HELO: delivery.mailspamprotection.com
Sending IP: 146.66.121.64
From: Khaled Al Awadi <sales@barterhutt.com>
Reply-To: jamesb080@vivaldi.net
Subject: Request for Quotation
Attachment: Order25072020.doc

AsyncRAT payload URL:
http://185.172.110.217/virp/Order2507.exe

Intelligence

File Origin

# of uploads :

# of downloads :

127

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilDoc.CROAndTheTangerineDream.M1.20200630.UNOFFICIAL

TwinWave.EvilDoc.CROAndTheTangerineDream.M2.20200630.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Replacing files

Changing a file

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Sending an HTTP GET request to an infection source by exploiting the app vulnerability

Creating a process from a recently created file

Result

Threat name:

AsyncRAT

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/397895

Signature

Binary contains a suspicious time stamp

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Office process drops PE file

Sigma detected: MS Office Product Spawning Exe in User Dir

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AsyncRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/077939298093e122bcec38dce3ca860b155f569a0ba2f9118cfcdd47ba7cd338/

Threat name:

Script-Macro.Trojan.Powload

Status:

Malicious

First seen:

2020-07-25 04:35:45 UTC

AV detection:

16 of 29 (55.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a54tskmaspqsfphmhdoohsugbmkv6vu2borpsemm7toupot42m4a._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro

Link:

https://tria.ge/reports/200725-hywrmzjx2x/

Behaviour

Suspicious Office macro

Office macro that triggers on suspicious action

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Virus

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/077939298093e122bcec38dce3ca860b155f569a0ba2f9118cfcdd47ba7cd338

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.