MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282
SHA3-384 hash: ffa60139f6425f333b2254e5c43ea215ee1eadfe747b61db75e594e2752789b95d3e70add4af222163cfb6d3ee197600
SHA1 hash: add2c041f12ce35e621dd3e162a61a7196eee48c
MD5 hash: 26454b46bef46b885e8477922d3d08d4
humanhash: dakota-orange-sodium-comet
File name:Alfa INS Invoice Print - #29738.pdf.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'599'888 bytes
First seen:2022-09-26 15:10:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash af58d77e2de72a34dfec8ea762118eda (2 x RecordBreaker, 1 x AsyncRAT, 1 x SystemBC)
ssdeep 49152:Ag6cnCiIkofSoKkVOUUi12RK27PB6yy0E6MenVeUQu:4VdSF3i12XDB62thUUj
TLSH T1D4751230DD036073DA7706F1E526C3C9D51BB5736D988528F91233E32EA0AEA5F99362
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 98acae8c9682b2b0 (1 x AsyncRAT, 1 x RemcosRAT, 1 x AgentTesla)
Reporter abuse_ch
Tags:AsyncRAT exe RAT signed

Code Signing Certificate

Organisation:wire.com
Issuer:R3
Algorithm:sha256WithRSAEncryption
Valid from:2022-08-28T04:23:15Z
Valid to:2022-11-26T04:23:14Z
Serial number: 0470ca705cf69cc37f882017ef7dac4e7e81
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 3bcee3a6c7eb01ec282fd9bcb74a0d0d818c9649148c1d25e20ccde17ff7b5dc
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
AsyncRAT C2:
190.123.44.184:8201

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
190.123.44.184:8201 https://threatfox.abuse.ch/ioc/851803/

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/313631/
Detection(s):
SecuriteInfo.com.Variant.Jaik.97930.31317.13643.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/39267/overview
Behaviour
MalwareBazaar
CPUID_Instruction
SystemUptime
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6331c109665fcdb8807a1f98/reports/3c6d5e16-3e77-4026-8fb5-5f4a3fb69c70/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/468f8047-745e-4986-883d-633fa9180c19
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
62 / 100
Link:
https://www.joesandbox.com/analysis/1077449
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AsyncRAT
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 709997 Sample: Alfa INS Invoice Print - #2... Startdate: 26/09/2022 Architecture: WINDOWS Score: 62 41 Snort IDS alert for network traffic 2->41 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 8 other signatures 2->47 7 Alfa INS Invoice Print - #29738.pdf.exe 4 2->7         started        11 DllHelper.exe 2->11         started        process3 file4 33 C:\Users\user\AppVerif\DllHelper.exe, PE32 7->33 dropped 35 C:\Users\...\DllHelper.exe:Zone.Identifier, ASCII 7->35 dropped 49 Self deletion via cmd or bat file 7->49 13 DllHelper.exe 7->13         started        16 cmd.exe 1 7->16         started        18 schtasks.exe 1 7->18         started        51 Writes to foreign memory regions 11->51 53 Allocates memory in foreign processes 11->53 55 Injects a PE file into a foreign processes 11->55 20 InstallUtil.exe 3 11->20         started        signatures5 process6 signatures7 57 Antivirus detection for dropped file 13->57 59 Writes to foreign memory regions 13->59 61 Allocates memory in foreign processes 13->61 63 Injects a PE file into a foreign processes 13->63 22 InstallUtil.exe 2 13->22         started        65 Uses ping.exe to check the status of other devices and networks 16->65 25 PING.EXE 1 16->25         started        27 conhost.exe 16->27         started        29 chcp.com 1 16->29         started        31 conhost.exe 18->31         started        process8 dnsIp9 37 190.123.44.184, 49695, 8201 ALTANREDESSAPIdeCVMX Panama 22->37 39 127.0.0.1 unknown unknown 25->39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-09-26 15:05:19 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
17 of 36 (47.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i6mz2jfgejqkz2wapucc4bs6qaabomjezkny2e5meuldhc242kba._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/220926-sklp6sbbe6/
Behaviour
Creates scheduled task(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
190.123.44.184:8012
190.123.44.184:8201
190.123.44.184:3321
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f4bf7d21-b326-48a0-80c4-4eee0ff92c24
Unpacked files
SH256 hash:
76a2f0dfd5be3ebba74937cc41cf92359f49934ed817648c82bd22a71fc8a5f4
MD5 hash:
bfae81eacdbf782e4b48fe10da0a3638
SHA1 hash:
17dc109d5c445e2adf6ed0f6750a5807f7d7a763
Link:
https://www.unpac.me/results/bb02e402-7d98-4f01-b4dd-9870ff3a1397/
SH256 hash:
47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282
MD5 hash:
26454b46bef46b885e8477922d3d08d4
SHA1 hash:
add2c041f12ce35e621dd3e162a61a7196eee48c
Link:
https://www.unpac.me/results/bb02e402-7d98-4f01-b4dd-9870ff3a1397/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47999d24a62260aceac07d042e065e8000173124ca9b8d13ac2516338b5cd282

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RansomwareTest6
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:RansomwareTest7
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/313631/

Comments