MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 509607c23436a0d4ef33b21734a19aa129fbcd63bad4cb2965f06fc3f32c2554. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 509607c23436a0d4ef33b21734a19aa129fbcd63bad4cb2965f06fc3f32c2554
SHA3-384 hash: 4057405381fc742632012175e914de55598e067fd561bdb9fe0cd47b9091f48b15eb39a1d85e78fe0896f464ee3fc9ac
SHA1 hash: 938dc62ac37f37a3ecaea6ebc8991d5797450a85
MD5 hash: 388be91ecda725cbdd443f402d441fd7
humanhash: lake-sweet-virginia-nebraska
File name:bZbVSVxG.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:51'200 bytes
First seen:2020-03-14 20:39:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 1536:C/LpxSZFtWxMbBrO+f1X3g+pabG2mVcl:eoCxMbBX39pp28Y
Threatray 274 similar samples on MalwareBazaar
TLSH 89331B003B98412AF1FE9F7C99F12545C7BAE3632613D65A3CC941DA0B13BC6DA426F6
Reporter johannes
Tags:AsyncRAT


Avatar
viql
asyncrat via https://pastebin.com/raw/bZbVSVxG

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Razy-7486442-0
Create hunting rule

Win.Packed.Razy-7649790-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-03-15 07:42:26 UTC
AV detection:
30 of 45 (66.67%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0eeb561ea16bf80e301847add0363445976f5ab518d23e499cbf1f7ce9e6fc59
AsyncRAT
137b5dc137f3f0c5bc3d4e1cd1f2396b33bd5b87291f72013a98b319c130b451
AsyncRAT
29753408215bfa4001c704237d4abd3755ea65e5cde05605436925185900f0ba
AsyncRAT
37965f22c013912043bab3cb214f8219ba54e3c3570132985fc37be5a9e4ba49
AsyncRAT
5515739bd8752264b7ee2a2c9b957d36af9fb16b19d7dd1aef4139f2fe74af47
AsyncRAT
5c93e522b96dfd6244f2e82bc06b8b14a8a2505bc05eff035d6acf3e50f69e07
AsyncRAT
5e21f7f70d7f4328f3d27e4b040ead9ffa6bab8f91dbb1fb9cb211058a4ea961
AsyncRAT
b05af3b65673a21e658075117c050ce9ebdf47634b64e354a6abf241fc8e8a9e
AsyncRAT
b398c602a2c9bab7ad128bcd189f83106244670cdf6b99782e59ed9d5435cef6
AsyncRAT
f019485de1ca48a37011e7df076b8e7105e928d4b2695caa1a6780a2a30f45cb
AsyncRAT
+ 264 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/509607c23436a0d4ef33b21734a19aa129fbcd63bad4cb2965f06fc3f32c2554

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://pastebin.com/raw/bZbVSVxG

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments