MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e9e908607cf5f2e839d584b96194f0cf64c66a788fcad12d9d31bd14d3d1415. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e9e908607cf5f2e839d584b96194f0cf64c66a788fcad12d9d31bd14d3d1415
SHA3-384 hash: e3c1650b58f40ee83dcf445f16dfaacd63442c2c38e58f0f2ffe21957191469dbececc5661424f23d487ff47fe761f10
SHA1 hash: 57d72e5623f085980ea8e7c4012655f1f8335035
MD5 hash: b8ae4393f751610681ef2947fbda6e5d
humanhash: carbon-september-pizza-pluto
File name:gunzipped.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:576'000 bytes
First seen:2021-09-29 09:16:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:nD4VHfQe6ZyWshg+qbZxTZZWunAWvjLeiQJSSkTLP2qpsGQ0c:nD4VHfQe6ZyWshg+qbZxTZZWunAWvjJC
Threatray 1'403 similar samples on MalwareBazaar
TLSH T11DC44B6DF60CE29EFC0903B121297CD425E81CAD1D7CBA17BEA6B5E230AED7551F0096
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
79.134.225.6:4419

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
79.134.225.6:4419 https://threatfox.abuse.ch/ioc/227745/

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
gunzipped.exe
Verdict:
Malicious activity
Analysis date:
2021-09-29 09:24:20 UTC
Tags:
trojan rat asyncrat
Link:
https://app.any.run/tasks/83ddcd94-c51d-4672-8d81-9014db7f5043

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
asyncrat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193059/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Creating a window
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d47a5268-b078-43b8-a8fd-8318bbc0723e
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/860711
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e9e908607cf5f2e839d584b96194f0cf64c66a788fcad12d9d31bd14d3d1415/
Threat name:
ByteCode-MSIL.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 09:17:06 UTC
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2pjbbqhz5ps5a45lbfzmgkpbt3eyzvhrd6k2ewz2mn5ctj5cqkq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0b8a5cbe236a7057a2904f18480b85ce9b59b891c0a1a041516248d35760744d
AsyncRAT
16fc0cec13d88da3d0a36e4c42e733db8f1e21cafc18fd813a25cd0bc835f35a
AsyncRAT
220bb2b7deba41f53a8d86d677691aff283314a29c27cc49b2ba396699237825
AsyncRAT
438e8f8d626ca18bb5fbd3499cad058033b199c865badba6415e362d5b8dcd49
AsyncRAT
b51c07d9a4e50ac499514d378320260821bd7486acd1077a6bddf8ab70c6a2b3
AsyncRAT
bcf7571a4d9b25fabdc2d6120b1b2d7bd8446ea2bc3a5da1d4127954920067de
AsyncRAT
ceddcfa72226e91f7435facafe6631d1385ca4d246d242d5136ac4e9462b8611
AsyncRAT
ecb8839117d73d33390c84f7f6e02f4970156ccb2da7b48083922f60625fa8be
AsyncRAT
fee6cda76d8c5b289b76deba1176049e529f51ac06f817a8a22ec77b17d74f35
AsyncRAT
+ 1'393 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat suricata
Link:
https://tria.ge/reports/210929-k816rsedhm/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Async RAT payload
AsyncRat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
Unpacked files
SH256 hash:
f8ea663ef7790c3716eb22674763ba26dfa8aff22a804135c54b2e4b5a563dbf
MD5 hash:
247039fe54b5a29e6c4580ad1639f58c
SHA1 hash:
f5f2ef2ec3a0ccf4bf9b35cc40fa8f428eca9eab
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/3954da21-32d5-4ce1-8efc-74e0fb47c1a1/
Parent samples :
2e9e908607cf5f2e839d584b96194f0cf64c66a788fcad12d9d31bd14d3d1415
a8fe103f14a401978ecf08b3bc878b1671b03e5a82ce869e50a469b172107728
SH256 hash:
6188b283097d4698cf3653930cd354117e78f2394c0fdefed4662ba668fe1fbd
MD5 hash:
adddddd2a6549e4e71b6f0faa21ba510
SHA1 hash:
b8667b368e4ebb63c3eff11860cbe84d14d681b3
Link:
https://www.unpac.me/results/3954da21-32d5-4ce1-8efc-74e0fb47c1a1/
SH256 hash:
e1bb63301b89f5e491e67aea2988b6ee2ca70fc9becfb35db8196f09a97b424f
MD5 hash:
102b9a22fae6b9041f0ed4921a3b1e18
SHA1 hash:
95f9d0b2515f0600dd6e603237808e348bcc9a49
Link:
https://www.unpac.me/results/3954da21-32d5-4ce1-8efc-74e0fb47c1a1/
SH256 hash:
6fef8420a8bd6a90cfe7ac8aeb0e3811422b9b6cb9e0b14ea03f5236438f72ba
MD5 hash:
10c7772f435231d58046e0dc34def127
SHA1 hash:
38c8f9ffb5136848d62582ef41bab6c810121c74
Link:
https://www.unpac.me/results/3954da21-32d5-4ce1-8efc-74e0fb47c1a1/
SH256 hash:
f7d272daf3522f99ca67b99bfe557564baba239104c7f20cef842f2e870bdf28
MD5 hash:
cceaca53d81061c0f1c6cf35ca7bf34b
SHA1 hash:
23ba45b249e0e4bdc5a8d4b4b07e2f7509cf85be
Link:
https://www.unpac.me/results/3954da21-32d5-4ce1-8efc-74e0fb47c1a1/
SH256 hash:
2e9e908607cf5f2e839d584b96194f0cf64c66a788fcad12d9d31bd14d3d1415
MD5 hash:
b8ae4393f751610681ef2947fbda6e5d
SHA1 hash:
57d72e5623f085980ea8e7c4012655f1f8335035
Link:
https://www.unpac.me/results/3954da21-32d5-4ce1-8efc-74e0fb47c1a1/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2e9e908607cf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e9e908607cf5f2e839d584b96194f0cf64c66a788fcad12d9d31bd14d3d1415

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/193059/

Comments