MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5687795956025667a92af458adfc60b32e82df2449a70740c9137609a52726f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5687795956025667a92af458adfc60b32e82df2449a70740c9137609a52726f6
SHA3-384 hash: 47e69e6d79071f6351688019af708f47421a9fbfec52b0db996352b25be47c07cdcdb0d09d0cfcfffeeabaed94f4a06c
SHA1 hash: b5b34e398c8a6ae722077a50edfefd1bf5433bd6
MD5 hash: f2d8938d773c6345ffd350920df21985
humanhash: mountain-pasta-zebra-winter
File name:Inquiry 02 MARCH 2022.xll
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:653'824 bytes
First seen:2022-03-02 18:38:57 UTC
Last seen:Never
File type:Excel file xll
MIME type:application/x-dosexec
imphash be710ba34b048ab0098050ccf62e369c (18 x Formbook, 14 x Dridex, 9 x AgentTesla)
ssdeep 12288:e0Ws7IMsR4yVld8bzbBSreYBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqjIT:e0bskX1IBY4ZyrE7K3yl8PeVooA/AB2f
Threatray 66 similar samples on MalwareBazaar
TLSH T193D46D51BECA6EA1EFBF47B78361D62D1126736E03A0A6CF6643019D3951FC2453EA03
Reporter abuse_ch
Tags:AsyncRAT xll

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-9939833-0
Create hunting rule

SecuriteInfo.com.Trojan.DownloaderNET.312.27193.19952.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Office Add-Ins - Suspicious
Link:
https://app.docguard.net/5687795956025667a92af458adfc60b32e82df2449a70740c9137609a52726f6/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/621fb9d1b94fb38cb43adbb9/reports/29e9bfe2-1333-4759-a170-91eadd115d6b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5687795956025667a92af458adfc60b32e82df2449a70740c9137609a52726f6/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-02 18:39:18 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
13 of 27 (48.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2dxswkwajlgpkjk6rmk37dawmxifxzejgtqoqgjcn3atjjhe33a._file
Verdict:
unknown
Similar samples:
0c2a4483319382571e9b470d292d0b4bdd4e7e700ff5722a979e4498c147693f
AsyncRAT
19e0b2abf3378d86d1f8d834eaf65f66079bfe64181ec13b50dc115e013b12d1
AsyncRAT
1bf8c12c3dadffb6d0b9dfbebd78a15bed670640830c0f41369ea6137c2aeb1d
AsyncRAT
4a9683f3b6658f4895cd3d44c4920d77db5dfd410cf0dc188e4f4d2740c24539
AsyncRAT
5d45566376f6d2724f2a799784589f52751abf462064bbfb9f5bab134ecd120c
AsyncRAT
61fe696f1f01753b90b6054fc390025f644a69a8c85a89dc83ac76cae19f79fb
AsyncRAT
727f124333294aaba156840955cbfc6ac7470768c65c1582c5e0dbfcb6f8722f
AsyncRAT
864b3cc362f84975007a63ae6f7fa6b4bdcc06f4459195896ebee385443ed44a
AsyncRAT
c61b6512d455398c2ff7fa4450c488e7eaeb8aacc01f732d8204ae302e2cc868
AsyncRAT
d724eef097700915a348d42dcfa0255e3edb3c644cf8740fd052cddab2c81b54
AsyncRAT
+ 56 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:2 persistence rat
Link:
https://tria.ge/reports/220302-xan5rshehl/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
212.193.30.54:9524
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5687795956025667a92af458adfc60b32e82df2449a70740c9137609a52726f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments