MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2b0002d2114e4a6c46b82c8a3e12f939d5b5ccc588e33a6b70238db5abc751bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AsyncRAT
Vendor detections: 12
| SHA256 hash: | 2b0002d2114e4a6c46b82c8a3e12f939d5b5ccc588e33a6b70238db5abc751bb |
|---|---|
| SHA3-384 hash: | 77712710b60bfcede523853d757c32ca339e902c3e40e4c622946f125d3b2e08f0223285dd70f582629ba6be28170fec |
| SHA1 hash: | 611e25853f144649850263c965cc3639ffc7bd7a |
| MD5 hash: | dd40ce0dbad0e51264b6d1f8511bed3a |
| humanhash: | mango-purple-georgia-victor |
| File name: | Aramco Urgent Inquiry.exe |
| Download: | download sample |
| Signature | AsyncRAT |
| File size: | 957'952 bytes |
| First seen: | 2021-06-22 07:31:06 UTC |
| Last seen: | 2021-06-22 08:49:45 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 12288:f0fWFHmOuSMPQipP5fdER5AZ0pLGTvEiVu5iRnMG3VFKCUwZbSe:LHtRippdE/JdGgiVoSBqCVZh |
| Threatray | 938 similar samples on MalwareBazaar |
| TLSH | 28159E124ECF426AE1798EB657B1FC4383B66DB62A0562163DC032EDC9335D6CCEE416 |
| Reporter |  abuse_ch |
| Tags: | AsyncRAT exe RAT |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 158.69.138.23:5505 | https://threatfox.abuse.ch/ioc/139821/ |
Intelligence
File Origin
# of uploads :
2
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Aramco Urgent Inquiry.exe
Verdict:
Malicious activity
Analysis date:
2021-06-22 07:32:30 UTC
Tags:
trojan rat asyncrat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
njRAT
Verdict:
Malicious
Result
Threat name:
AsyncRAT
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Detection:
asyncrat
Threat name:
Win32.Trojan.Pwsx
Status:
Malicious
First seen:
2021-06-22 07:31:12 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
asyncrat
Similar samples:
+ 928 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Score:
10/10
Tags:
family:asyncrat rat spyware stealer
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Reads user/profile data of web browsers
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
kingmethod.duckdns.org:5505
kingmethod.duckdns.org:9909
kingmethod.duckdns.org:4404
kingmethod.duckdns.org:9909
kingmethod.duckdns.org:4404
Unpacked files
SH256 hash:
1e42c6f8131a6ce576ff85f2dbacf14508dfe256f98321daafe4567342d3c429
MD5 hash:
dea1e0d92c244a5b9206f9077a7b76f8
SHA1 hash:
b064002743dbd279252de3c6a03186fb80907864
SH256 hash:
e67f4c7bf12c3b9f6b52ad1eafb27aceedf6927c2d06a2025b18f59ff8920d2b
MD5 hash:
d908fc4302717bfd1a9980078d7965f1
SHA1 hash:
06031541ed1a406fec672d9ebc46136590de7a75
Detections:
win_asyncrat_w0
SH256 hash:
05bb41332fbfa187ceec786d5d6e3fbd2af416f10b02184ad392035c57763c8f
MD5 hash:
d7220fba2094e24d6ac023cb72481e2a
SHA1 hash:
2e88503b802e6ace665025394b32ae8958be3e6f
SH256 hash:
2b0002d2114e4a6c46b82c8a3e12f939d5b5ccc588e33a6b70238db5abc751bb
MD5 hash:
dd40ce0dbad0e51264b6d1f8511bed3a
SHA1 hash:
611e25853f144649850263c965cc3639ffc7bd7a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.