MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80
SHA3-384 hash:	b48d17012c1ea65d71cb140a4cec4a5c9e3ab2c9da0bf0e806cb77379c90671c5233ffde0e6c8eb4b15acb1655b07434
SHA1 hash:	f764941cab201f441d31edd23120961966799880
MD5 hash:	bb16b36f5fe5781959183b0acd63de8b
humanhash:	snake-sweet-charlie-washington
File name:	asegurar.vbs
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	2'015'602 bytes
First seen:	2024-12-02 11:14:30 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	192:DlVUdVoZvsBef7e3vtEMUETN9BgKm6w56Hy:CQb7SOE9Tm6wd
Threatray	2'704 similar samples on MalwareBazaar
TLSH	T14995EE4DDF793BBB52A0D39A5AC184D2229F727418460CCDEA8559CDC1BC9F73F0898A
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	mp3
Reporter	lontze7
Tags:	AsyncRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

99

Origin country :

FR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.32733.23315.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674d97c0e64d1c722d7b4edc

Tags:

xtreme gumen shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/674d96b9e0aad38b941f8d3c/reports/3a071cd4-f18d-4113-8636-8dfa380e4f4b/overview

Hybrid Analysis Trojan.Script.VBS

Verdict:

Suspicious

Labled as:

Trojan.Script.VBS

Link:

https://www.hybrid-analysis.com/sample/2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1566545

Signature

AI detected suspicious sample

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Encrypted powershell cmdline option found

Found suspicious powershell code related to unpacking or dynamic code loading

Malicious sample detected (through community Yara rule)

Potential dropper URLs found in powershell memory

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Paste sharing url in reverse order

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80/

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-11-29 00:02:15 UTC

File Type:

Text (VBS)

AV detection:

1 of 24 (4.17%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=faima3gpaiykeqlzgy4gfp6u5cg2wbnrwop3ekoxlohqdfz73oaa._file

Threatray asyncrat

Verdict:

malicious

Label(s):

asyncrat

Alert

Create hunting rule

Similar samples:

0a5d1450c71befec5a5aeacaffc6dd7d6514de1693071af6c0b7ed1e2f9f540f

AsyncRAT

8a9c1f6cbb3c007686dd49723babb95afc94933aabf1c2012e395ee3ecf3a65b

AsyncRAT

8f0613fe4583c969434cb928ed94baf45c505d39af6a4cc0217be08d2378bc1f

AsyncRAT

b030a9aaa27be2c9db6c0f15e95626025f51430466b13a196908b1ec4172160c

AsyncRAT

b3ebae9c04c8ab1c5aee3c6733fd02bd67117d7028666c71f385dbb2fce426ff

AsyncRAT

e8b7c888c9ea980cf728bc8e7fbbf2db6deccd62b7252e673e77fcce9f740f9b

AsyncRAT

error

AsyncRAT

+ 2'694 additional samples on MalwareBazaar

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:tarea 2 discovery execution rat

Link:

https://tria.ge/reports/241202-ncjtdssje1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Legitimate hosting services abused for malware hosting/C2

Checks computer location settings

Blocklisted process makes network request

AsyncRat

Asyncrat family

Malware Config

C2 Extraction:

wins.cooempresasltda5.store:8000

Dropper Extraction:

https://pastebin.com/raw/Adv9gBHa

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2810c06ccf0230a24179363862bfd4e88dab05b1b39fb229d75b8f01973fdb80