🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bd325fa05c5184178ff65feacb70183c180e3e119ba77dc52b5171a952fde61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bd325fa05c5184178ff65feacb70183c180e3e119ba77dc52b5171a952fde61
SHA3-384 hash: fa7acaffadfd25bc45b9078efb7e4c7d37ffddeeabdfbee4f844e4c8304bde347499f86454184f242864fca0babbef83
SHA1 hash: d9667b4aee3c2e2181b94254874edaaa56fe599d
MD5 hash: 87c386fca6a77e9d7692962b37e20393
humanhash: sad-maryland-football-violet
File name:remcos.zip
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:53'335 bytes
First seen:2023-01-15 02:06:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: infected
ssdeep 1536:E04Dv7GgXqIi/0S1SEnBb0x22ZTzRZA/PI:B+GcI/0ynyHnRZcI
TLSH T14D33F1B05C3BA278D3DF2FB7D21108246DA158157FDDC9432A05449FBCAF56A2F22788
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter x3ph1
Tags:AsyncRAT remcos zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
US US
File Archive Information

This file archive contains 7 file(s), sorted by their relevance:

File name:asyncrat.bin
File size:48'640 bytes
SHA256 hash: da7c929bf15c5b5f503449155f5000987a35916cb8cd97ce46b3509a16cfd6ac
MD5 hash: 0963c0a7c0e73f190194192701496473
MIME type:application/x-dosexec
Signature AsyncRAT
File name:asyncrat_decompiled.out
File size:70'023 bytes
SHA256 hash: 94f7e95eeaffb6c6c2e863c791f593e4c6e9fcc96cd4df524578c4e89184660b
MD5 hash: 236cae5b2cd76d6745b34e777d41bd89
MIME type:text/x-c++
Signature AsyncRAT
File name:disassembly_shellcode.txt
File size:51'564 bytes
SHA256 hash: 8f846edc994d74ab4c508a19aba4021491a9e999cffa9fe4628b56ea60c84877
MD5 hash: 3b1166bbe646d1bf54e1922e1bf5fc45
MIME type:text/plain
Signature AsyncRAT
File name:const
File size:2'048 bytes
SHA256 hash: 6ebf4ab815391a5b3ae70b1520816102a9995e16c416e92e932ddcd137e45679
MD5 hash: c35c55337fd603a51404ded8de4770d5
MIME type:application/octet-stream
Signature AsyncRAT
File name:code
File size:6'144 bytes
SHA256 hash: 1357ac6d1b121d47def6bb2e233220efaeed41a12ed87c9a9f69e61c649cccb7
MD5 hash: a5aff614ade59e5dfbfe8020a8975fb2
MIME type:application/octet-stream
Signature AsyncRAT
File name:data
File size:512 bytes
SHA256 hash: 75b55654e175bed566b59059484a38c4fdb8c30836ca284c5e2092623547f250
MD5 hash: 84d2e294e10891d773f6de93d382de8f
MIME type:application/octet-stream
Signature AsyncRAT
File name:dynwrapx.dll
File size:13'312 bytes
SHA256 hash: 4ef3a6703abc6b2b8e2cac3031c1e5b86fe8b377fde92737349ee52bd2604379
MD5 hash: e0b8dfd17b8e7de760b273d18e58b142
MIME type:application/x-dosexec
Signature AsyncRAT
Vendor Threat Intelligence
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/2bd325fa05c5184178ff65feacb70183c180e3e119ba77dc52b5171a952fde61/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm configsecuritypolicy.exe evasive hacktool mpcmdrun.exe msconfig.exe njrat packed rat regedit.exe
Link:
https://www.filescan.io/uploads/63c35fc6de614a115a164d9d/reports/e88abf46-267a-46f4-bdb6-32bb0bbbaaa0/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bd325fa05c5184178ff65feacb70183c180e3e119ba77dc52b5171a952fde61/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-15 03:12:15 UTC
AV detection:
3 of 39 (7.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpjsl6qfyumec6h7mx7kznybqpayby7bdg5hpxcswulrvfjp3zqq._file
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:newyourk rat
Link:
https://tria.ge/reports/230115-jhjncsbh43/
Behaviour
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
141.95.84.40:3060
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2bd325fa05c5184178ff65feacb70183c180e3e119ba77dc52b5171a952fde61

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments