MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74
SHA3-384 hash: d08636cace134b8be72fbce07d521ad7b7df2cd1c63ecf1812df3e9b06da40df06b2fc8aa8ab1543abcdd5bba249734a
SHA1 hash: 1de0d09d5731ee580de782ab6a090997a5403b46
MD5 hash: 1415244fa17fe0a50a7868e4b3984c39
humanhash: georgia-connecticut-moon-hamper
File name:9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:188'416 bytes
First seen:2020-06-29 07:35:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 3072:P+eghdZSHUBO8wozCLYQcBOdXKrXHqFTXUH+NEMFwTcadj0AI:3ghdEPUeMfw87QT/NEMOTcOjs
Threatray 550 similar samples on MalwareBazaar
TLSH 9E04AD0A3B9CE627C67D19F698D21B4413F659BB6242F7DE6CC061A424C37F58A223C7
Reporter JAMESWT_WT
Tags:AsyncRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15760/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 07:07:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tfq5xvnfxkzqtpfvxg5exwztqwnnahidz27sneg74gu4q5dnnj2a._file
Verdict:
suspicious
Similar samples:
031b0bcde6e169070993f85f816ecaf48f46a90f40f2d08cf5e0089d11d25e32
AsyncRAT
19bc9feb4b0530d0858d726c4381c431cf0e627781f88f2a6b1401671d4745e4
AsyncRAT
1fa1363c857cc46f603a4eff38b86058b80ecca1f554c65e943f94725b5c2570
AsyncRAT
76933bfe9afdf8d266352155f09995acadcab23345fabe2518d5bf15d45c9cd4
AsyncRAT
8470a2e93ae48abb1b987d9927277eb7a3bde99fe0d048274f839cc25aa3aa95
AsyncRAT
851f1641fb283113cc5feb03c807bc82dc4d85ecd22ab8ff091a8edd71bb45ed
AsyncRAT
a9316a887a00dbf992833394b7a4e05db6e6e6929f66419a06ebbccf358e45b4
AsyncRAT
b8214924a598b9fd3193099fecd6c3d09f06dc5e3a9af098642c7d5327c05cd3
AsyncRAT
b9620fd88aff4f05ecddda888f13bd8c5780f6fb2c1f5df66c64ce5854cd82d8
AsyncRAT
f302282c8f607b9b5225217fa0c83e843057b8e69097d36c0c70f9e8c533697e
AsyncRAT
+ 540 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-edlzq6y5r6/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15760/

Comments