MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73ffaa868244eb4bcee7027ce57d30e604dda4dcda00fcfcbfb43103909ea52b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	73ffaa868244eb4bcee7027ce57d30e604dda4dcda00fcfcbfb43103909ea52b
SHA3-384 hash:	f7d2f4bc2259eb907cadf95f0754a242400e735353cf6c1c79047fa11120f891de133578caf7448b27dd31d486dc2650
SHA1 hash:	c3ac0100bc0187e2a3fc384e2c54a63e79ea22d0
MD5 hash:	f91fab099adc5ae1cf49b9451ea334f5
humanhash:	single-bluebird-lithium-river
File name:	TT COPY.pdf...exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	462'336 bytes
First seen:	2020-10-26 14:05:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:TssiGkHx2U/oD1D3BDUwbjCLjpMedFGzbKxQXUNLXxQb47ALxLNmGb:sxJG4wC9MacbKxQENdu4kdL
Threatray	343 similar samples on MalwareBazaar
TLSH	F1A49C4963E88536DDFFE6B5E434810A9F39BC5E9535CB8E2A8170DF237BB40A900761
Reporter	abuse_ch
Tags:	AsyncRAT exe GoDaddy RAT

abuse_ch

Malspam distributing AsyncRAT:

HELO: p3nlsmtpcp01-02.prod.phx3.secureserver.net
Sending IP: 184.168.200.140
From: Suzana Kahid <info@ssufine.com>
Reply-To: info@ssufine.com
Subject: MT103/202 COPY
Attachment: TT COPY.img (contains "TT COPY.pdf...exe")

AsyncRAT C2s:
chongmei33.publicvm.com:49746 (178.33.222.241)
rahim321.duckdns.org (192.169.69.25)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

AsyncRat

Link:

https://www.capesandbox.com/analysis/79105/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Creating a file

DNS request

Connection attempt

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Forced shutdown of a system process

Sending a TCP request to an infection source

Connection attempt to an infection source

Unauthorized injection to a system process

Result

Threat name:

AsyncRAT

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/511867

Signature

Initial sample is a PE file and has a suspicious name

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Writes to foreign memory regions

Yara detected AsyncRAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/73ffaa868244eb4bcee7027ce57d30e604dda4dcda00fcfcbfb43103909ea52b/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-26 04:47:09 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=op72vbucitvuxtxhaj6ok7jq4ycn3jg43iapz7f7wqyqhee6uuvq._file

Verdict:

malicious

Label(s):

asyncrat

Result

Malware family:

asyncrat

Score:

10/10

Tags:

rat persistence family:asyncrat

Link:

https://tria.ge/reports/201026-x7f9w6xr5s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

Uses the VBS compiler for execution

Async RAT payload

AsyncRat

Malware Config

C2 Extraction:

chongmei33.publicvm.com:49746
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:49714
185.165.153.116:49746
185.165.153.116:2703
185.165.153.116:49714
54.37.36.116:49746
54.37.36.116:2703
54.37.36.116:49714
185.244.30.92:49746
185.244.30.92:2703
185.244.30.92:49714
dongreg202020.duckdns.org:49746
dongreg202020.duckdns.org:2703
dongreg202020.duckdns.org:49714
178.33.222.241:49746
178.33.222.241:2703
178.33.222.241:49714
rahim321.duckdns.org:49746
rahim321.duckdns.org:2703
rahim321.duckdns.org:49714
79.134.225.92:49746
79.134.225.92:2703
79.134.225.92:49714
37.120.208.36:49746
37.120.208.36:2703
37.120.208.36:49714

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	asyncrat Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect AsyncRat in memory
Reference:	internal research

Rule name:	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse Create hunting rule
Author:	ditekSHen
Description:	Detects file containing reversed ASEP Autorun registry keys

Rule name:	Reverse_text_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Reverse text detected

Rule name:	win_asyncrat_j1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects AsyncRAT

Rule name:	win_asyncrat_w0 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect AsyncRat in memory
Reference:	internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

img 0b19b8ddcc59f4712d0d9020ad373ab8e600b01bf67bfb3d7e56d736162967b0

AsyncRAT

exe 73ffaa868244eb4bcee7027ce57d30e604dda4dcda00fcfcbfb43103909ea52b

(this sample)

Dropped by

MD5 ca9833c48684c2f3aebb7c8f56fb9cb1

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/79105/

Dropped by

SHA256 0b19b8ddcc59f4712d0d9020ad373ab8e600b01bf67bfb3d7e56d736162967b0

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample