MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3464d5b88ea3f3d4c0c8735e681f8514f6a7abc9039f1f3372340f7513f3448e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 13


Intelligence 13 IOCs 1 YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3464d5b88ea3f3d4c0c8735e681f8514f6a7abc9039f1f3372340f7513f3448e
SHA3-384 hash: 8fde796414eb9ba124e2ceea0c12a662f235dc9343295f7653b348f3aa7acba8d18681db33d719295bce3a2c3bd21a72
SHA1 hash: 9c703f2d4be5286ab2eed92dc7637acb5457b10b
MD5 hash: d7e9fc4cb4efe177b4461d54994bb0e9
humanhash: earth-seventeen-march-black
File name:D7E9FC4CB4EFE177B4461D54994BB0E9.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:198'400 bytes
First seen:2021-05-15 18:50:47 UTC
Last seen:2021-05-15 19:34:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ced282d9b261d1462772017fe2f6972b (127 x Formbook, 113 x GuLoader, 70 x RemcosRAT)
ssdeep 3072:If1BDZ0kVB67Duw9AMc/2ltqxVbgSa1B+1sK8zLH+Smng7esYJuYFqTxVE1TaIRu:I9X0G2PqxZgSyJKsePg76kEqfia0u
Threatray 2'127 similar samples on MalwareBazaar
TLSH B214121B7BA0EC7FC83287B41DBBA319CFDADA1530661B839B545A467D032871A2F1C4
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
91.109.186.7:5380

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
91.109.186.7:5380 https://threatfox.abuse.ch/ioc/43039/

Intelligence

File Origin
# of uploads :
3
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
D7E9FC4CB4EFE177B4461D54994BB0E9.exe
Verdict:
Malicious activity
Analysis date:
2021-05-15 18:53:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/39433dcb-14e9-42be-8bb7-c6347c44812d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/157425/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Sending a UDP request
Creating a file in the %AppData% subdirectories
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Snake Keylogger
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/03dad9b4-9267-4d45-b111-08d0bba5ac60
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/782834
Signature
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Drops PE files with benign system names
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 415230 Sample: xGD2DbQ7Lg.exe Startdate: 15/05/2021 Architecture: WINDOWS Score: 100 85 Multi AV Scanner detection for domain / URL 2->85 87 Found malware configuration 2->87 89 Multi AV Scanner detection for dropped file 2->89 91 5 other signatures 2->91 9 xGD2DbQ7Lg.exe 1 20 2->9         started        13 dwm.exe 16 2->13         started        16 dwm.exe 17 2->16         started        18 9 other processes 2->18 process3 dnsIp4 65 C:\Users\user\AppData\Roaming\...\dwm.exe, PE32 9->65 dropped 67 C:\Users\user\AppData\Local\...\xc8x7.dll, PE32 9->67 dropped 95 Detected unpacking (changes PE section rights) 9->95 97 Detected unpacking (overwrites its own PE header) 9->97 99 Maps a DLL or memory area into another process 9->99 101 Drops PE files with benign system names 9->101 20 xGD2DbQ7Lg.exe 7 9->20         started        81 192.168.2.1 unknown unknown 13->81 69 C:\Users\user\AppData\Local\...\xc8x7.dll, PE32 13->69 dropped 103 Multi AV Scanner detection for dropped file 13->103 105 Detected unpacking (creates a PE file in dynamic memory) 13->105 107 Machine Learning detection for dropped file 13->107 23 dwm.exe 3 13->23         started        71 C:\Users\user\AppData\Local\...\xc8x7.dll, PE32 16->71 dropped 26 dwm.exe 16->26         started        83 127.0.0.1 unknown unknown 18->83 73 C:\Users\user\AppData\Local\...\xc8x7.dll, PE32 18->73 dropped 109 Changes security center settings (notifications, updates, antivirus, firewall) 18->109 28 dwm.exe 18->28         started        30 MpCmdRun.exe 18->30         started        file5 signatures6 process7 dnsIp8 59 C:\Users\user\AppData\Local\Temp\dwm.exe, PE32 20->59 dropped 61 C:\Users\user\AppData\...\xGD2DbQ7Lg.exe.log, ASCII 20->61 dropped 32 cmd.exe 1 20->32         started        34 cmd.exe 1 20->34         started        77 fact.azad.live 104.21.13.168, 5380 CLOUDFLARENETUS United States 23->77 79 172.67.200.214, 5380 CLOUDFLARENETUS United States 23->79 37 cmd.exe 23->37         started        63 C:\Users\user\AppData\Local\...\dwm.exe.log, ASCII 28->63 dropped 39 conhost.exe 30->39         started        file9 process10 signatures11 41 dwm.exe 17 32->41         started        45 conhost.exe 32->45         started        47 timeout.exe 1 32->47         started        93 Uses schtasks.exe or at.exe to add and modify task schedules 34->93 49 conhost.exe 34->49         started        51 schtasks.exe 1 34->51         started        53 conhost.exe 37->53         started        55 schtasks.exe 37->55         started        process12 file13 75 C:\Users\user\AppData\Local\...\xc8x7.dll, PE32 41->75 dropped 111 Maps a DLL or memory area into another process 41->111 57 dwm.exe 41->57         started        signatures14 process15
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3464d5b88ea3f3d4c0c8735e681f8514f6a7abc9039f1f3372340f7513f3448e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-14 04:26:00 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=grsnloeoupz5jqgionpgqh4fct3kpk6jaopr6m3sgqhxke7tisha._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
133d378b2120357d5bab7586ff33b0bf55a4411b78b9c9ac4f340c9b8cea6fc8
AsyncRAT
213528a5164fcb5253010129aac3855b4b905c9c5a9514a2a2b9db7e2b592a73
AsyncRAT
2edc93f84e6911e5b86040964715868c82eb28c2b48cdbb2c72dee60cfe2f792
AsyncRAT
4d13e663aebabe2376c4f231356688108b5a124e0aafbc1717efa9f82e23f2b2
AsyncRAT
7abcb717c38fe87ca0b5fbc03422fc1b19dc23742457ace0836016278fdba132
AsyncRAT
7da044c42ca2197b24b974350ae45f50ba9573714685c175026ff4a29a57973b
AsyncRAT
86b22d8497ac1df55b76bddca6c021ec4b9995b00caea5effeeffe4e9f592e44
AsyncRAT
9ee67445d4ffeedd7c11e1e14949bf0f6060f34352e3f2c8d2184ffe0b4d235f
AsyncRAT
ddaaa650d42caaed5ddd7c307b986cdccfc25bcb84c7a4f29f9fddd26add4135
AsyncRAT
eb918b8f920a7f710cbd2460ba6132a177996912cc0ef6144ac824e3e37e4fdb
AsyncRAT
+ 2'117 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat persistence rat
Link:
https://tria.ge/reports/210515-yayvdqstnn/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
fact.azad.live:5380
societyf500.ddns.net:5380
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AsyncRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3464d5b88ea3f3d4c0c8735e681f8514f6a7abc9039f1f3372340f7513f3448e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/157425/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-15 18:59:24 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [C0032.001] Data Micro-objective::CRC32::Checksum
2) [C0026.002] Data Micro-objective::XOR::Encode Data
5) [C0045] File System Micro-objective::Copy File
6) [C0046] File System Micro-objective::Create Directory
7) [C0048] File System Micro-objective::Delete Directory
8) [C0047] File System Micro-objective::Delete File
9) [C0049] File System Micro-objective::Get File Attributes
10) [C0051] File System Micro-objective::Read File
11) [C0050] File System Micro-objective::Set File Attributes
12) [C0052] File System Micro-objective::Writes File
13) [E1510] Impact::Clipboard Modification
14) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
15) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
16) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
17) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
18) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
19) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
20) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
21) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
22) [C0017] Process Micro-objective::Create Process
23) [C0038] Process Micro-objective::Create Thread
24) [C0018] Process Micro-objective::Terminate Process