MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f26650c608fd0f9a206313627fc9274e5149f3a91000a4efd22edad7e66a380. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 12

Intelligence 12 IOCs YARA 6 File information Comments 1

SHA256 hash:	2f26650c608fd0f9a206313627fc9274e5149f3a91000a4efd22edad7e66a380
SHA3-384 hash:	eca4f84404cc56f6b3e9f94927e6200dc6165dff146cbb31ff4a6457c909a3f753ad3d2ae5c8cadb43671b5199b02972
SHA1 hash:	f3afc612ea9b2aeecacb4b4e1792b6b1800ef870
MD5 hash:	b0b110907b803c315662fafcf1893595
humanhash:	oranges-north-maine-one
File name:	b0b110907b803c315662fafcf1893595
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	537'600 bytes
First seen:	2021-07-16 09:12:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:/YmM8TBwwuu4GUDf42O+8JD3zCotFWhGpZim5Nd75yworSpajcp:wDSBgZXWFghGpZikPse
Threatray	1'022 similar samples on MalwareBazaar
TLSH	T192B48DAE339835AFC77FC036BA64AC55FB50A8A337078D0B818311D9994F9439A45CBD
Reporter	zbetcheckin
Tags:	32 AsyncRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

139

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b0b110907b803c315662fafcf1893595

Verdict:

Malicious activity

Analysis date:

2021-07-16 09:15:39 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5e602f03-f35f-4c5b-89d0-034f08b8dfdc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

AsyncRat

Link:

https://www.capesandbox.com/analysis/172155/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.5506.UNOFFICIAL

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fed41556-5664-4909-b007-63403c45b28e

Result

Threat name:

AsyncRAT

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/817386

Signature

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM3

Yara detected AsyncRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

asyncrat

Link:

https://mwdb.cert.pl/sample/2f26650c608fd0f9a206313627fc9274e5149f3a91000a4efd22edad7e66a380/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-07-15 12:53:11 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=f4tgkddar7iptiqgge3cp7esotsrjhz2seaautx5elw227tguoaa._file

Verdict:

malicious

Label(s):

asyncrat

AsyncRAT

220bb2b7deba41f53a8d86d677691aff283314a29c27cc49b2ba396699237825

AsyncRAT

438e8f8d626ca18bb5fbd3499cad058033b199c865badba6415e362d5b8dcd49

AsyncRAT

a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b

AsyncRAT

b51c07d9a4e50ac499514d378320260821bd7486acd1077a6bddf8ab70c6a2b3

AsyncRAT

bcf7571a4d9b25fabdc2d6120b1b2d7bd8446ea2bc3a5da1d4127954920067de

AsyncRAT

c8cc7c1a1210a082960b929c3598521979e16c1c6f5626b8ad29b9618ab5e18c

AsyncRAT

ceddcfa72226e91f7435facafe6631d1385ca4d246d242d5136ac4e9462b8611

AsyncRAT

fee6cda76d8c5b289b76deba1176049e529f51ac06f817a8a22ec77b17d74f35

AsyncRAT

+ 1'012 additional samples on MalwareBazaar

Result

Malware family:

asyncrat

Score:

10/10

Tags:

family:asyncrat rat

Link:

https://tria.ge/reports/210716-pal8pb8l2x/

Behaviour

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Async RAT payload

AsyncRat

Malware Config

C2 Extraction:

icando.ug:6970
icacxndo.ac.ug:6970

Unpacked files

SH256 hash:

3940469f3c5bba9efdba4d2f59b129ca8f153ba08cbcf687223c36a7760b60fb

MD5 hash:

089e8d291bd0a40413b6c81ba5884587

SHA1 hash:

a9e1006daef25f262d6b53e315b3df5e2786ccfe

Detections:

win_asyncrat_w0

Link:

https://www.unpac.me/results/2dcb81e9-de90-4a98-ba0b-ff9d3903a095/

Parent samples :

43be223943f2ff74295ae0f865df3613c84d022ed9819f2f49fc6a46c87b8ce3
91b422ee25b307df923fa0c14996c0b3748c953a9238041b45e671a9cbac0cf3
adcac50d0023e4f7103f3870fe9fc1ef9873904fcb1d7765b4ac589c0d12d47f
a79b2f3ba8546f37e5a9944c36daebd10e4ccc7fb4b3e9563e85722f7214327d
22e55a154209025c55a6a4683572f1e90808bf49ba5c22ba96d32aabb6ac3e7d
35dcbf854bded7a05d9c724eae755e272f9c976e9202217195eebcf9abead846
d42beb6c20833eaed3d603706c03ae2a620f95a4a2fe0eea239636c97575ca24
53c65fc1c8d98aafd58dd6bcf3409b6b3518ac35d87a980582791ba18ebf24dc
7d1af03f32295405a8277cdf18fc04eb56e2f38b3bc50d67dc68fd0ebfb25975
9c8d663a84c8dff4985caa5cc816a1951ef7873387d41ce8aed67e7e00a4cb7a
74793bc735c85a0aa392628532d0f27d6bf3d93c399d8b364e50f7353b0a1427
396f9ceaa242e93b96be8e003fd35503808e9f534922fbb15eb433f6cc290347
83e6a747674cd9170716b631509ae0ff69f3347421fb2a4b4b463c557bb0b3cc
2f26650c608fd0f9a206313627fc9274e5149f3a91000a4efd22edad7e66a380
2d5d1a4d6bc5abb1e0ad26c3d9801a44317d0a50a370db5de488763b98fc766b
c742310103ec1e2fb8c24de96d31ca042639d171c3264c4df385f273f8b018e1
c9f2834a9860d26cfe06748d933b338c5f511a01442ade25930d292b52f1f625

SH256 hash:

e6a42dcd0be4260a6f13d4b28cbbbb80a725d8089a277c115fd2f8b7cd167ec6

MD5 hash:

944f971b94eaba11f5885cab309ad2ed

SHA1 hash:

57316f0da876569fbc6864b9b214316669940c37

Link:

https://www.unpac.me/results/2dcb81e9-de90-4a98-ba0b-ff9d3903a095/

SH256 hash:

7aca3887fa6d6fcfef407a19baff1224bd308cbace90a28be40bc3c5068b3f64

MD5 hash:

a3d242db63e9ec55add865598df96a36

SHA1 hash:

530d58187b20f97d463001b75b0beee00a097fda

Link:

https://www.unpac.me/results/2dcb81e9-de90-4a98-ba0b-ff9d3903a095/

SH256 hash:

2f26650c608fd0f9a206313627fc9274e5149f3a91000a4efd22edad7e66a380

MD5 hash:

b0b110907b803c315662fafcf1893595

SHA1 hash:

f3afc612ea9b2aeecacb4b4e1792b6b1800ef870

Link:

https://www.unpac.me/results/2dcb81e9-de90-4a98-ba0b-ff9d3903a095/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2f26650c608fd0f9a206313627fc9274e5149f3a91000a4efd22edad7e66a380

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	asyncrat Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect AsyncRat in memory
Reference:	internal research

Rule name:	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse Create hunting rule
Author:	ditekSHen
Description:	Detects file containing reversed ASEP Autorun registry keys

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	win_asyncrat_j1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects AsyncRAT

Rule name:	win_asyncrat_w0 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect AsyncRat in memory
Reference:	internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

exe 2f26650c608fd0f9a206313627fc9274e5149f3a91000a4efd22edad7e66a380

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1437335/

URLhaus

https://urlhaus.abuse.ch/url/948787/

Cape

https://www.capesandbox.com/analysis/172155/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-07-16 09:12:12 UTC

url : hxxp://erolasa.ac.ug/ac.exe