MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 689a6e8c6f83f8282d05c9d3b9798fbd98cd3140a0a7f8fd45e5bc38be912f6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 689a6e8c6f83f8282d05c9d3b9798fbd98cd3140a0a7f8fd45e5bc38be912f6c
SHA3-384 hash: b4a464263bc1ef9017eee37ad9544f96561e12b13a18f1055f60d39a1a23454e06980f96efdf88f2c0d6c6fdb64a849b
SHA1 hash: 4c9f8bd5aff96a427f0d705332fab131eeb17363
MD5 hash: 05f3ba46cadb429752f3351f3b0f0ed0
humanhash: connecticut-saturn-chicken-fix
File name:52023.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:216'576 bytes
First seen:2020-06-15 13:55:27 UTC
Last seen:2020-06-22 09:15:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 3072:ZoirU4Z+1PlnATeVTQF6sgGQ/G3Ar0QQOYTuWINGxFfVAYcLqztd0xPeE0FlgeOz:OZtxATeVq1QOqQpTZI6FZgea
Threatray 443 similar samples on MalwareBazaar
TLSH 0A246C8C2BBC29D7C7AEC679C0D5410C87F4D077955AEFAABC8625E41A0B3A2F5015CB
Reporter James_inthe_box
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8171/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.28618.26241.23171.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-13 09:58:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncng5ddpqp4cqlifzhj3s6mpxwmm2mkauct7r7kf4w6drpurf5wa._file
Verdict:
malicious
Similar samples:
3088265bbf0f8411c83bdc19d76ed6a2c8ac566fbebabdf77466b32a1fbe3d3e
AsyncRAT
33e5803e360f1d0bd569f6033bd55fdb787b263dd334bb0a7c110fb8cf4d9ded
AsyncRAT
6bc82b5b3a1161abc9ef0b67d69e09ef009fed1ab438fb9e5f3e1ac40290ed78
AsyncRAT
7623519a30d274a1587ff9822c506535dcb72fd773a4a960cc5fe9c4b7a9a0f4
AsyncRAT
87346c61f33de8032a07485854ff530fc91d48770ab3f6c660c78f20575686b3
AsyncRAT
a4e4d40fd07df5f60ccf8ce1f8657ae5bde6d46132e8a463b5f38805b1a2e889
AsyncRAT
a7dfe0b2d7e830b64d7d3a450914ae7f5ac73bda4b0013ca5dcf2e7ba5ee5595
AsyncRAT
bdcccb43f004bc9cde60a7a7a0b152cce2bb11583d8c1a30a24b754e7693fba0
AsyncRAT
c338d425a1293b82ac13c856c43d588ce0053b27349620b7353273a42a04d845
AsyncRAT
d4a48ebb40a694aa456a25cc4b8dc9230517de9e0708a64adeb6ccec13f0c1d6
AsyncRAT
+ 433 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat persistence rat
Link:
https://tria.ge/reports/201109-2bybxdvcme/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Maps connected drives based on registry
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
79.134.225.71:8808
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/8171/
Cape
Cape
https://www.capesandbox.com/analysis/8168/

Comments