MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 035ee55b03afb96a70ca0cb79001a6ea3c33f9b6b8f85e816d21ab5faf9f21bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 035ee55b03afb96a70ca0cb79001a6ea3c33f9b6b8f85e816d21ab5faf9f21bf
SHA3-384 hash: 95187f62d2ab8246729abe4b815aa4f75d60856bc09f441777cac0e67334cb58916232c6601622713e9f6a0295331cbb
SHA1 hash: 80606933c59ff88acb3531adc076bf91db620126
MD5 hash: 3670814ea9cf16db9800b8a46292e8cc
humanhash: nineteen-tennis-three-black
File name:phencwg9ns.ps1
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:118'910 bytes
First seen:2022-05-25 16:30:37 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 1536:Rw1/+MStf5P+37hVXq4jWc4QOTHqtYB8hU29BtPz1NuYOWI:K/wfkvOTHCEGVDuR
TLSH T1DDC321F4A345D5EADC8B056FA89D7E21D4A90B27D7CF008823E8707D1BBCB86476158E
Reporter pr0xylife
Tags:AsyncRAT ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
494
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
njrat powershell rat
Link:
https://www.filescan.io/uploads/628e5a05eba388bb8682b89e/reports/816a4fcf-de10-43a0-86ac-6098fa1e8365/overview
Result
Verdict:
MALICIOUS
Result
Threat name:
AsyncRAT, DcRat
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1001728
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Compiles code for process injection (via .Net compiler)
Drops VBS files to the startup folder
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AsyncRAT
Yara detected DcRat
Yara detected Generic Downloader
Yara detected RUNPE
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 634224 Sample: phencwg9ns.ps1 Startdate: 25/05/2022 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 12 other signatures 2->54 8 powershell.exe 28 2->8         started        12 wscript.exe 1 2->12         started        process3 file4 38 C:\Users\user\...\SystemLoginHomePage.vbs, ASCII 8->38 dropped 60 Drops VBS files to the startup folder 8->60 62 Writes to foreign memory regions 8->62 64 Compiles code for process injection (via .Net compiler) 8->64 66 Injects a PE file into a foreign processes 8->66 14 csc.exe 3 8->14         started        17 InstallUtil.exe 1 2 8->17         started        20 conhost.exe 8->20         started        68 Wscript starts Powershell (via cmd or directly) 12->68 22 powershell.exe 20 12->22         started        signatures5 process6 dnsIp7 42 C:\Users\user\AppData\Local\...\rt0w4ijm.dll, PE32 14->42 dropped 25 cvtres.exe 1 14->25         started        46 franc01.publicvm.com 91.193.75.218, 49749, 49813, 7196 DAVID_CRAIGGG Serbia 17->46 44 C:\Users\user\AppData\Local\...\i2bq5gw2.0.cs, C++ 22->44 dropped 56 Writes to foreign memory regions 22->56 58 Injects a PE file into a foreign processes 22->58 27 csc.exe 3 22->27         started        30 conhost.exe 22->30         started        32 InstallUtil.exe 22->32         started        34 InstallUtil.exe 22->34         started        file8 signatures9 process10 file11 40 C:\Users\user\AppData\Local\...\i2bq5gw2.dll, PE32 27->40 dropped 36 cvtres.exe 27->36         started        process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/035ee55b03afb96a70ca0cb79001a6ea3c33f9b6b8f85e816d21ab5faf9f21bf/
Threat name:
Script-PowerShell.Trojan.Invoker
Create hunting rule
Status:
Malicious
First seen:
2022-05-25 16:31:05 UTC
File Type:
Text (PowerShell)
AV detection:
9 of 26 (34.62%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat suricata
Link:
https://tria.ge/reports/220525-t1cymsfgbk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
Async RAT payload
AsyncRat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
Malware Config
C2 Extraction:
franc01.publicvm.com:7196
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/035ee55b03afb96a70ca0cb79001a6ea3c33f9b6b8f85e816d21ab5faf9f21bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments