MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 387c08f088753f350e49e5404b42b4bdf2fb44d43a5f7685714cf1f509a6f82e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 387c08f088753f350e49e5404b42b4bdf2fb44d43a5f7685714cf1f509a6f82e
SHA3-384 hash: 600884e93b218bf97338e0bee53f0060ed8ca16891f034e39117c3292e4bcd70b2402ae0fe9c4ef10cdf18fbd4e0911e
SHA1 hash: 1cc7c6fe33ebe0222bb3f22300a7a600574b4671
MD5 hash: eb4af7d03ef748444d3b388411a2a76b
humanhash: football-twelve-avocado-equal
File name:SKM_C258201001130020005057.7z
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:103'140 bytes
First seen:2020-12-22 07:02:53 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 3072:cpTGTUq3FRtvhGYzR0+s2F6AgPe6Ckzr0a2EKJ24:cpTGT9zuY6pHPtLzFsJv
TLSH 16A312E5AF8556270C0403E421059DFD3ADB1A556B8608E2BE0DA2E6387DEFC7570A3B
Reporter abuse_ch
Tags:7z AsyncRAT DHL RAT


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: s1008.xrea.com
Sending IP: 150.95.9.228
From: DHL Customer Service <noreply@dhl.com>
Subject: Your Package Delivery
Attachment: SKM_C258201001130020005057.7z (contains "SKM_C258201001130020005057.exe")

AsyncRAT C2:
severdops.ddns.net:6204

Intelligence

File Origin
# of uploads :
1
# of downloads :
315
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader36.29944.9165.28410.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/387c08f088753f350e49e5404b42b4bdf2fb44d43a5f7685714cf1f509a6f82e/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 07:03:04 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hb6ar4eiou7tkdsj4vaewqvuxxzpwrguhjpxnblrjty7kcng7axa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/387c08f088753f350e49e5404b42b4bdf2fb44d43a5f7685714cf1f509a6f82e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

7z 387c08f088753f350e49e5404b42b4bdf2fb44d43a5f7685714cf1f509a6f82e

(this sample)

AsyncRAT

Executable exe 8d29f4ed1dfb22f2b11e74a065ca6f8993cead1cbd965f576a935cf80fb1afc7

  
Dropping
MD5 101293648c64868f186872244df8b871
  
Dropping
AsyncRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d29f4ed1dfb22f2b11e74a065ca6f8993cead1cbd965f576a935cf80fb1afc7

Comments