MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67741e596f4d59713a232bfb45d6cb0b2592f67b867773f72c2bb0fa2f749685. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67741e596f4d59713a232bfb45d6cb0b2592f67b867773f72c2bb0fa2f749685
SHA3-384 hash: b0f6c9b3753bfc9e3dd3a7884e04c70fa072d5760471b624de324eb2d826dc9d2ddf6275b76d55b052d20b90f64478af
SHA1 hash: 4a05baf2027180366471de77bfe26b9e53917f7e
MD5 hash: 70640074d3fdae9d73d37db169c4e2fb
humanhash: hot-nevada-freddie-angel
File name:70640074D3FDAE9D73D37DB169C4E2FB.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:38'912 bytes
First seen:2022-01-28 21:40:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:WakFl+TZPIs6oP9uCkf+0rgCNkz/xvgztVgWcuaZ1k+++b1:WBNkq4/k+++b
Threatray 100 similar samples on MalwareBazaar
TLSH T19A030753B66C87BDE56A47F0416A86044B71B91720A2D72C7CEEB4CF5AB1B80C790B33
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
20.83.245.27:1604

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
20.83.245.27:1604 https://threatfox.abuse.ch/ioc/357716/

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
70640074D3FDAE9D73D37DB169C4E2FB.exe
Verdict:
Malicious activity
Analysis date:
2022-01-28 21:44:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/11eb31c1-9ec1-40a7-bd7a-6997f5536321

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/225620/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Creating a file
Creating a process from a recently created file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Creating a window
Unauthorized injection to a recently created process
Sending a TCP request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/61f462f3c4bcf3287a65a115/reports/cacda2ca-c073-4a5b-924f-c472dca8b1af/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a710e162-e872-4455-95d9-b87301b877d1
Result
Threat name:
44Caliber Stealer AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/930010
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/67741e596f4d59713a232bfb45d6cb0b2592f67b867773f72c2bb0fa2f749685/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2022-01-25 18:42:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m52b4wlpjvmxcordfp5ulvwlbmszf5t3qz3xh5zmfoypul3us2cq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0e7d9b0985b55dbf3c9978c57f6cf0c76e36751517ad6b224cdee2fe221cc9ca
AsyncRAT
1b7d7515f98891cf08164a7469bb9c9f3133e7834cfe99d55094594ca330e982
AsyncRAT
2b706f2254c046cc98027519e95de07d7e0d63ac61733db9c42fc2995b69fe48
AsyncRAT
371aab310f82dd4f64f09981c1d3d8974f18227c98679af43bd0559ec6752dde
AsyncRAT
5e4bbf19a6e055cc6c2c98ef38288f3465c30e25542b735fbfca921fdb8b95f9
AsyncRAT
610ba149c7874ac9c4e30d8a65ae5bb8a94d68d544ce97e8337cdeb75a8ed674
AsyncRAT
694175c88d632f08a6ad09a9be03aac4a82432cc5c3cc0e3e3dfdd7f360af651
AsyncRAT
8bc0620aa9e06ff8861c9cbba4ea13329b42b13fe35c9ba35c30580cf27068b3
AsyncRAT
bc81c1f42f33236e77ec08654b84fe226e6565015b0fe961a739a19e219703e5
AsyncRAT
f6e9cc10809960c2b980b291f5f430e3555c7f9315d0a81ccbbf008c477f0d23
AsyncRAT
+ 90 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default pyinstaller rat spyware stealer
Link:
https://tria.ge/reports/220128-1jtndsefe3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Detects Pyinstaller
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
20.83.245.27:1604
Unpacked files
SH256 hash:
67741e596f4d59713a232bfb45d6cb0b2592f67b867773f72c2bb0fa2f749685
MD5 hash:
70640074d3fdae9d73d37db169c4e2fb
SHA1 hash:
4a05baf2027180366471de77bfe26b9e53917f7e
Link:
https://www.unpac.me/results/6cc69a74-a3cf-49ff-b4fc-6d32f2b65de0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/67741e596f4d59713a232bfb45d6cb0b2592f67b867773f72c2bb0fa2f749685

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/225620/

Comments