MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments

SHA256 hash:	4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a
SHA3-384 hash:	9698fed736d85428a9839157038538ccf692f9d559164d4c53a26cff081d5c2063ac6979d8f6744bb694841dc9c32136
SHA1 hash:	0d46677df13b3bf35ac9e58b47e1c195986544e4
MD5 hash:	f1c5354b87df83758f0aedb56212a4ae
humanhash:	oven-pennsylvania-wisconsin-thirteen
File name:	Signed P.O.pdf.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	4'315'619 bytes
First seen:	2025-02-04 21:37:15 UTC
Last seen:	2025-02-04 22:21:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b1c5b1beabd90d9fdabd1df0779ea832 (11 x CoinMiner, 10 x QuasarRAT, 8 x AsyncRAT)
ssdeep	98304:MqwH/xfzlaBbb0wVhYkQvwV+nX8RMkw3tY0SJe:MqwHJfRaB8wVjQYVqX8W33W0SJe
Threatray	192 similar samples on MalwareBazaar
TLSH	T126161244E59408F8FC7BDB34A8778C15E5773C6A9A70634E175E71252FBB2C06A2AE03
TrID	76.9% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 16.7% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 3.0% (.EXE) Win64 Executable (generic) (10522/11/4) 1.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.5% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
File icon (PE):
dhash icon	f6f9b5e6c486b3c9 (6 x Formbook, 6 x RemcosRAT, 4 x AgentTesla)
Reporter	Anonymous
Tags:	AsyncRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

539

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Signed P.O.pdf.exe

Verdict:

No threats detected

Analysis date:

2025-02-04 21:38:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/76aaf692-7a28-4155-a1ff-b59b916e80cb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.BackDoor.AgentTeslaNET.35.16014.3421.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a28a012dcee78dd8196233

Tags:

underscore asyncrat autorun

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% subdirectories

Launching a process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm asyncrat fingerprint installer masquerade microsoft_visual_cc obfuscated overlay packed packed packer_detected sfx

Link:

https://www.filescan.io/uploads/67a28890e7790b912a1e0626/reports/bc2cb3c6-0088-4363-8410-9582bac7ecb8/overview

Verdict:

Malicious

Labled as:

Trojan.Uztuby

Link:

https://www.hybrid-analysis.com/sample/4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/a16c2980-27ea-4695-98f3-7dc1bdcb74dc

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1606864

Signature

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension File Execution

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a/

Threat name:

ByteCode-MSIL.Backdoor.AsyncRAT

Status:

Malicious

First seen:

2025-02-03 15:51:43 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jrlkrojeasbaaecx7fces7vkzgapshemwteauz636peha3vttefa._file

Verdict:

malicious

Label(s):

asyncrat

unknown_loader_037

AsyncRAT

4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a

AsyncRAT

5a283f2f193bd78816d21cc62d0bb67a5570bc631f5c3752444abc28515e542c

AsyncRAT

854d267aea33e8dc80021ac043b003ab7c6f99061e56e36572cba3548e6882c9

AsyncRAT

9a4c96b227213b7049f851572487d42c994220bbf584f631bf347a507b684c1a

AsyncRAT

9eeebefec3e56c3308628ad425c20ae61d5a079c2ca0256f2868709b22baf4b0

AsyncRAT

d013f217195c38d4c65063ba7001c7e2bd2b131fa0e130e5f3814ea72f0dd91a

AsyncRAT

error

AsyncRAT

+ 182 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250204-1gk88svngk/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a17dcfd9-7599-4908-90d4-7f97ec59f119

Unpacked files

SH256 hash:

4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a

MD5 hash:

f1c5354b87df83758f0aedb56212a4ae

SHA1 hash:

0d46677df13b3bf35ac9e58b47e1c195986544e4

Link:

https://www.unpac.me/results/60e0864e-4447-4adc-a424-12b8ef3823e9/

SH256 hash:

5a283f2f193bd78816d21cc62d0bb67a5570bc631f5c3752444abc28515e542c

MD5 hash:

b12869ee25cc50e4ebb7c66fd75b7b35

SHA1 hash:

765488b8536cd89a7bd8ef0100ef97e9d7014c34

Link:

https://www.unpac.me/results/60e0864e-4447-4adc-a424-12b8ef3823e9/

Malware family:

AsyncRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4c56a8b92404/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4c56a8b9240482001057f944497eaac980f91c8cb4c80a67dbf3c8706eb3990a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SelfExtractingRAR Create hunting rule
Author:	Xavier Mertens
Description:	Detects an SFX archive with automatic script execution

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (FORCE_INTEGRITY)	high

Reviews

ID	Capabilities	Evidence
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipAlloc
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AllocConsole KERNEL32.dll::AttachConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample