MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
SHA3-384 hash: 536da2935bb9961cc5e693bdc11ee34df18054611f9b4a3b45aab43b4ded75e14eb15431fedd7209e61df559ce01f4c3
SHA1 hash: 0e87ec191765cbb62e9103e4cebc754314002e7d
MD5 hash: 4661d321d22ead59aa1dcf7805b9680e
humanhash: harry-lion-papa-april
File name:4661d321d22ead59aa1dcf7805b9680e.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:160'256 bytes
First seen:2022-11-28 20:10:18 UTC
Last seen:2022-11-28 21:29:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'743 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:O6HomkMh4smo4GvX9m7+VBe16y71T+w/2FbM44:3+obvtIZIy7Wl
TLSH T1DBF3BE172BC58BAFD95902377CA7630037B0DA46D9A3CB0B3549F2605FB33D851A2799
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 71d4b2e8b2e0e871 (1 x AsyncRAT)
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
185.252.178.121:5126

Intelligence

File Origin
# of uploads :
2
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
4661d321d22ead59aa1dcf7805b9680e.exe
Verdict:
Malicious activity
Analysis date:
2022-11-28 20:10:39 UTC
Tags:
trojan rat asyncrat
Link:
https://app.any.run/tasks/b5d3181b-a1c9-4ad8-a9a4-ffc0506d674e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/339540/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.47297.10713.30029.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Running batch commands
Creating a file
Creating a file in the %AppData% subdirectories
Launching a process
Сreating synchronization primitives
DNS request
Creating a window
Sending a custom TCP request
Creating a process from a recently created file
Unauthorized injection to a recently created process
Setting a global event handler for the keyboard
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm asyncrat obfuscated packed samas
Link:
https://www.filescan.io/uploads/638515d624da1c12cfe1f070/reports/2b846440-76de-4662-be8a-bd380f397fd1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f6184517-1924-4596-bb9c-58c1fd7d7f90
Result
Threat name:
AsyncRAT, PhoenixRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1122858
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AsyncRAT
Yara detected Generic Downloader
Yara detected PhoenixRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 755582 Sample: 44krE7RHDt.exe Startdate: 28/11/2022 Architecture: WINDOWS Score: 100 66 Snort IDS alert for network traffic 2->66 68 Malicious sample detected (through community Yara rule) 2->68 70 Multi AV Scanner detection for submitted file 2->70 72 8 other signatures 2->72 7 44krE7RHDt.exe 4 2->7         started        10 EregData.exe 3 2->10         started        13 EregData.exe 2 2->13         started        15 EregData.exe 2->15         started        process3 file4 60 C:\Users\user\AppData\...\44krE7RHDt.exe.log, ASCII 7->60 dropped 17 cmd.exe 3 7->17         started        20 cmd.exe 2 7->20         started        23 44krE7RHDt.exe 2 7->23         started        32 2 other processes 7->32 76 Multi AV Scanner detection for dropped file 10->76 78 Machine Learning detection for dropped file 10->78 26 cmd.exe 10->26         started        28 cmd.exe 1 10->28         started        34 2 other processes 10->34 30 cmd.exe 13->30         started        36 3 other processes 13->36 signatures5 process6 dnsIp7 56 C:\Users\user\AppData\...regData.exe, PE32 17->56 dropped 58 C:\Users\...regData.exe:Zone.Identifier, ASCII 17->58 dropped 38 conhost.exe 17->38         started        74 Uses schtasks.exe or at.exe to add and modify task schedules 20->74 40 conhost.exe 20->40         started        62 xxxprofxxx.dnsdojo.com 185.252.178.121, 49705, 5126 LVLT-10753US Germany 23->62 64 192.168.2.1 unknown unknown 23->64 48 2 other processes 26->48 42 conhost.exe 28->42         started        50 2 other processes 30->50 44 conhost.exe 32->44         started        52 2 other processes 32->52 46 conhost.exe 34->46         started        54 2 other processes 36->54 file8 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1/
Threat name:
Win32.Backdoor.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2022-11-24 00:42:09 UTC
File Type:
PE (.Net Exe)
Extracted files:
20
AV detection:
20 of 40 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3g4t5xl2a26q44nktkcnbwvogzhepb4a62dd2onkuop4hijxdiq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/221128-yx89wsdc89/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
xxxprofxxx.dnsdojo.com:5126
Unpacked files
SH256 hash:
181f8be08f5622275ba18f7ad58ed7b9ac8c7b552bf37135ebb8aed59b4074c6
MD5 hash:
e5b7f248c7f698103a259ea81e6481d1
SHA1 hash:
62881d55f972b28e9e595cc1f856f525fdf46212
Detections:
AsyncRAT
Create hunting rule
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/6d4de058-882a-4b44-a29c-ef93c0194a33/
Parent samples :
4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
181f8be08f5622275ba18f7ad58ed7b9ac8c7b552bf37135ebb8aed59b4074c6
SH256 hash:
4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1
MD5 hash:
4661d321d22ead59aa1dcf7805b9680e
SHA1 hash:
0e87ec191765cbb62e9103e4cebc754314002e7d
Link:
https://www.unpac.me/results/6d4de058-882a-4b44-a29c-ef93c0194a33/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ecdc9f6ebd035e8738d54d42686d571b2723c3c07b431e9cd551cfe1d09b8d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/339540/

Comments