MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 035c9b74eb554db2c071ab90d77d252027c36ba3995597fb61f81ef0f72c911e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 035c9b74eb554db2c071ab90d77d252027c36ba3995597fb61f81ef0f72c911e
SHA3-384 hash: c85fa34144f7fc5ef233ce289b1f71457741555a85077b766e3fd6861525c98dea9b638a150c15ac53b884300d0afecd
SHA1 hash: a336a84416d6829cba05001248685c97d8344571
MD5 hash: d32481e5d392f9346f8b857be5e2a60a
humanhash: washington-charlie-mirror-cat
File name:PO87875620 2022 DEC.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:248'320 bytes
First seen:2022-12-06 08:15:18 UTC
Last seen:2022-12-06 09:35:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'654 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 6144:N9jJoVYlB0QZroh5jleTF64opuhFgA/Kl6GP4x6OoKeaz:BcYhZrEjleTF64AuhFV/Kby6Yz
Threatray 4'232 similar samples on MalwareBazaar
TLSH T14034F145BAC8709FCA5FCE7E89213D15962C60127703F343A8A132BC59496FDA993BD3
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 30b2c4c8c8c4b030 (53 x Formbook, 41 x RemcosRAT, 20 x AgentTesla)
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
194.5.98.198:4545

Intelligence

File Origin
# of uploads :
2
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
PO87875620 2022 DEC.exe
Verdict:
Malicious activity
Analysis date:
2022-12-06 08:16:20 UTC
Tags:
asyncrat
Link:
https://app.any.run/tasks/472fa4ec-e152-49ee-9545-31b74de78972

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/343307/
Detection(s):
SecuriteInfo.com.W32.MSIL_Agent.EFE.gen.Eldorado.20311.5903.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a process
Creating a file
Сreating synchronization primitives
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/638efa440c6473d16719a2c3/reports/e8d7d58f-6607-4b5f-b65e-5a4f3502a3e1/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dba9d691-47be-4123-b1d9-b943e70ed8e7
Result
Threat name:
AsyncRAT, PhoenixRAT
Create hunting rule
Detection:
malicious
Classification:
spre.troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1128837
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Drops PE files to the startup folder
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Copy file to startup via Powershell
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Generic Downloader
Yara detected PhoenixRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 761561 Sample: PO87875620 2022 DEC.exe Startdate: 06/12/2022 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Antivirus detection for URL or domain 2->40 42 15 other signatures 2->42 7 PO87875620 2022 DEC.exe 1 2->7         started        11 SyNnJjstem.exe 1 2->11         started        process3 file4 28 C:\Users\user\...\PO87875620 2022 DEC.exe.log, ASCII 7->28 dropped 44 Writes to foreign memory regions 7->44 46 Allocates memory in foreign processes 7->46 48 Injects a PE file into a foreign processes 7->48 13 powershell.exe 14 7->13         started        17 RegSvcs.exe 2 7->17         started        20 powershell.exe 3 11->20         started        22 RegSvcs.exe 2 11->22         started        signatures5 process6 dnsIp7 30 C:\Users\user\AppData\...\SyNnJjstem.exe, PE32 13->30 dropped 32 C:\Users\...\SyNnJjstem.exe:Zone.Identifier, ASCII 13->32 dropped 50 Drops PE files to the startup folder 13->50 52 Powershell drops PE file 13->52 24 conhost.exe 13->24         started        34 chexfotii.ddns.net 194.5.98.198, 4545, 49686 DANILENKODE Netherlands 17->34 26 conhost.exe 20->26         started        file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/035c9b74eb554db2c071ab90d77d252027c36ba3995597fb61f81ef0f72c911e/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-12-06 08:16:08 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
23 of 26 (88.46%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=anojw5hlkvg3fqdrvoino7jfeat4g25dtfkzp63b7appb5zmsepa._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0a05f8788ca28d5f4e2ad838a36f83107326d3021fc5bc9824fe2c47dfd07712
AsyncRAT
16e7ad0f3c49622609f9e31253a81fca1521fc0ec0501be9773950d500abf571
AsyncRAT
2e75072eae7fa044b3ee05b2ba378823bbfa3091ceb5612f33b637c0d0764a21
AsyncRAT
5468fe6c4a8a65ed2e4e3c101c8fd0191b9773acc51ae61da6d446057958511b
AsyncRAT
8e3079b83ab70db97e2508e7a9a57a8a5ce124b1524c6a64867b5ff33edcbdca
AsyncRAT
959e3ca2579b6be8a11c06763c5a34ec118abc96d869e25bef06319c92da465e
AsyncRAT
eee7f4dd424733c57b1fe3712d215129f3494536bf6277d1811417c8a0a1baae
AsyncRAT
f0e61a30a68cacde89ef636511dfae2b488bcbe9b47053c3afc0718d66324f70
AsyncRAT
fb5500d8ead47d2daccdc10705f398285037e115bb73380a682e8a4481715dc5
AsyncRAT
+ 4'222 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/221206-j55t4sch2z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
chexfotii.ddns.net:4545
Unpacked files
SH256 hash:
925e5950692b3ea38cf661cf011c6825fbc349f926104c808fd036f7ed5438b9
MD5 hash:
dcb0e52b313bc80ec3ee02c1c01cee84
SHA1 hash:
6f64b33468f3ea9900742f253b2f5d75b4700e1c
Link:
https://www.unpac.me/results/c805cade-21ea-48da-b28a-435370004955/
SH256 hash:
bfa12a2456d40d6c32a1f4e35bd43c81f6f67466234faed8fec19397d0e6d808
MD5 hash:
7a7927bac28be846b2fd2a5d10ba0676
SHA1 hash:
67a7b8616fc8e7aa7bb7a6e2521548e67a7caa2d
Link:
https://www.unpac.me/results/c805cade-21ea-48da-b28a-435370004955/
Parent samples :
fb110b1db7c02725d6cb0953cf153a2b5e158d358db136aece90ac06d79cb07d
80dd6d009a2b7ab7aa393d063048320db5ea3920a4fd9cca4a0a76f12183273f
SH256 hash:
3858236937405a61e5a5608a7e81783b5d3d723ad3751f2f7fa277daa15d86e1
MD5 hash:
7dada739f7e20092d1b1d79b457cf228
SHA1 hash:
675331971b3cdf0c1cf5e9d0691a8a4a09a6b684
Link:
https://www.unpac.me/results/c805cade-21ea-48da-b28a-435370004955/
SH256 hash:
035c9b74eb554db2c071ab90d77d252027c36ba3995597fb61f81ef0f72c911e
MD5 hash:
d32481e5d392f9346f8b857be5e2a60a
SHA1 hash:
a336a84416d6829cba05001248685c97d8344571
Link:
https://www.unpac.me/results/c805cade-21ea-48da-b28a-435370004955/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/035c9b74eb55/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/035c9b74eb554db2c071ab90d77d252027c36ba3995597fb61f81ef0f72c911e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/343307/

Comments