MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21d6b8e83e7ab0a47651684e9ab0923a7cd9bbb00df04fab16c726e46b6c64f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21d6b8e83e7ab0a47651684e9ab0923a7cd9bbb00df04fab16c726e46b6c64f9
SHA3-384 hash: 13f30fbfdba0ea29cf8efd6660a7440fc30b376c77be6163e97fb3d23529ecde1a9ae649dc8b5ba05e4b5894e4e3e7c2
SHA1 hash: 2691ea93fb667ac4fd34fab5059fdd6c9953995d
MD5 hash: d48f540f367d97abeaa7d6ee4801170f
humanhash: winter-march-quiet-michigan
File name:Sathya Raj-CV.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:360'960 bytes
First seen:2022-01-31 09:17:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:EgcqEZ8K8g8KtGBjVO7JpyTaNyZVvGjTU5n99nLQ++LOs:fcqEbQjVO7JxTSTc7
Threatray 2'415 similar samples on MalwareBazaar
TLSH T1FF745BB491BB8651F11BCA74652CFA2002F334E3A9C68F79572A3641CFA9F543E8560F
Reporter pr0xylife
Tags:AsyncRAT exe

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.193.75.135:3030 https://threatfox.abuse.ch/ioc/370952/

Intelligence

File Origin
# of uploads :
1
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Sathya Raj-CV.exe
Verdict:
Malicious activity
Analysis date:
2022-01-31 09:21:51 UTC
Tags:
trojan rat asyncrat
Link:
https://app.any.run/tasks/2c80af2e-c3df-46a5-82d9-0d161af564a0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/228368/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61f7a94fd7fd65ae55fbb1cc/reports/266dc99c-a806-4235-a361-4e88047416dd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0114f9fb-b156-4be5-85fc-026df3252595
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/930848
Behaviour
Behavior Graph:
n/a
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/21d6b8e83e7ab0a47651684e9ab0923a7cd9bbb00df04fab16c726e46b6c64f9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-31 09:18:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehllr2b6pkyki5srnbhjvmeshj6nto5qbxye7kywy4toi23mmt4q._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
1d89428d461fe418e454be54a63ee6c27d61fe17b83286871ee18d1599dda156
AsyncRAT
30a2e2f5aaecca9e137bb27b823011c4e7e994525cbf16a61ed47ac682ca6717
AsyncRAT
3d932a053e1421f810d277c21eba678f239b066169b1cfc21e380a135d7c8fd1
AsyncRAT
6c26868470adaf2dbac1718393836da06c23fd53c9d0d9912642628912c8c2bb
AsyncRAT
8f9a34a821f52b05d7ec60c32575e79faedea1dd0f30fd6537fc7928e47bd107
AsyncRAT
a9ee744d7181c80db0ffbabf36933b815cf8b731ad6fb920393fb325cdfce9cc
AsyncRAT
c1775805532530f23ebd9df5cfcd3b1b4bbfd740271fae4f30d398cff129691b
AsyncRAT
d0eabfe28f6b77c25d883ad3e380620f1367082cc58f309e4d24dd1d2c3548c8
AsyncRAT
fc74933986ac3619850c028d84642f70effa6775eaf2bdce09a2cf1c0feb2c33
AsyncRAT
+ 2'405 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat suricata
Link:
https://tria.ge/reports/220131-k9nbasghcq/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Async RAT payload
AsyncRat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
Unpacked files
SH256 hash:
b69654739a0b9e1c168b86841193bf109f1d0610c07c959597a207c7101a76d1
MD5 hash:
054515728c7725f00c981ba476e07bba
SHA1 hash:
f018824501927da1e3f50e8d50ac52935f02b2a4
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/1cae8a18-2c90-42c2-a612-efcf31158069/
Parent samples :
20126f0e6a271df71f9ab0838c03bb6554b106773f66fb9c28eb7bf4e685399d
bcb3f5843cba83b163c793e06e5d583a021da1c5794fdd7e484e6ad0f9655e8f
21d6b8e83e7ab0a47651684e9ab0923a7cd9bbb00df04fab16c726e46b6c64f9
8b7d427dcc9fea937ba95cb5fb1d3788662f2a07909b9d150c5495084cd56ce7
f43d01e6d686fceed7d7612fdcc3e4f6e39e80af8c020fffb7c8c1ab74e57fb0
879855eb9b481225aea2cd966c4b9781a517d664c06ea32debb1bdd067a45faa
77fc50e59287031c6d133db4018b2f1217eb32b80e8ee90832337d924bfd5b0b
da6abb6f3aae250d50ed09b6eacc267c33e50895e3ebd7e6ba800ab018351ec5
SH256 hash:
6f1b89bc3013177c101fe4448340c48c0dd08d19017a798bd11c2d0f76be1fbc
MD5 hash:
60a604887b3616e3ed86d81fab0a9ebb
SHA1 hash:
8db84f5f4c569c86c69aff464b2ffc4ce3dafa20
Link:
https://www.unpac.me/results/1cae8a18-2c90-42c2-a612-efcf31158069/
SH256 hash:
d9984052dbb6e42c25309f479212ec73644ddca0fc5e398ad3dd88ecc7387c79
MD5 hash:
a21ae3cb0bf99ff74f239b0d9d6394ee
SHA1 hash:
2c0474ffee4cad6eeac6bd39013f2baf97ef664a
Link:
https://www.unpac.me/results/1cae8a18-2c90-42c2-a612-efcf31158069/
SH256 hash:
21d6b8e83e7ab0a47651684e9ab0923a7cd9bbb00df04fab16c726e46b6c64f9
MD5 hash:
d48f540f367d97abeaa7d6ee4801170f
SHA1 hash:
2691ea93fb667ac4fd34fab5059fdd6c9953995d
Link:
https://www.unpac.me/results/1cae8a18-2c90-42c2-a612-efcf31158069/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/21d6b8e83e7a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21d6b8e83e7ab0a47651684e9ab0923a7cd9bbb00df04fab16c726e46b6c64f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:malware_asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/228368/

Comments