MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7933ad4edab82e52f977bc9623aa7b24f63ac959efbf1cd5c8ecf73a4207b9c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 12


Maldoc score: 9


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7933ad4edab82e52f977bc9623aa7b24f63ac959efbf1cd5c8ecf73a4207b9c1
SHA3-384 hash: 67afeb41289a3a1d086556f1605c8aa604ba4e38c6a90474d009c234238d8fd973644e3050315eefcbcbf6a8ab4ef7ee
SHA1 hash: 6bc828610e03758ea7121983b9e281b8e8b6fb47
MD5 hash: a7a4f3a4aa943e3bd5e78789cec486d6
humanhash: quiet-king-sierra-steak
File name:Order1040258.xlsm
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:441'461 bytes
First seen:2022-06-30 15:51:04 UTC
Last seen:Never
File type:Excel file xlsm
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 12288:K4XQu7SHOCZhSTIS2dGpeWpqivD1YxR25O8UG:gwarmMSAGMID1R5OtG
TLSH T157942300C7D19E6AAC8440F7EF14CBC840E37093A58F2D492B6CB96D60DBC6E516E9EC
TrID 42.2% (.XLAM) Excel Macro-enabled Open XML add-in (83500/1/13)
29.1% (.XLSM) Excel Microsoft Office Open XML Format document (with Macro) (57500/1/12)
17.2% (.XLSX) Excel Microsoft Office Open XML Format document (34000/1/7)
8.8% (.ZIP) Open Packaging Conventions container (17500/1/4)
2.0% (.ZIP) ZIP compressed archive (4000/1)
Reporter abuse_ch
Tags:AsyncRAT RAT xlsm


Avatar
abuse_ch
AsyncRAT C2:
62.197.136.167:1111

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
62.197.136.167:1111 https://threatfox.abuse.ch/ioc/738660/

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 9
OLE dump

MalwareBazaar was able to identify 8 sections in this file using oledump:

Section IDSection sizeSection name
A1537 bytesPROJECT
A289 bytesPROJECTwm
A3169 bytesVBA/Sheet1
A4344 bytesVBA/ThisWorkbook
A5171 bytesVBA/Workbook
A67 bytesVBA/_VBA_PROJECT
A7228 bytesVBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
IOC46.249.35.196IPv4 address
IOCcertutil.exeExecutable file name
IOCOrder1040258.exeExecutable file name
IOCAgynyddjasev.exeExecutable file name
SuspiciousShellMay run an executable file or a system command
SuspiciousvbHideMay run an executable file or a system command
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
310
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
File type:
application/vnd.ms-excel.sheet.macroEnabled.12
Has a screenshot:
False
Contains macros:
True
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/284634/
Detection(s):
TwinWave.EvilDoc.GreenSlantPicturesOfU.XL.220404.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PublicDottedQuadDLrRunLikeHell.20210223.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CertUtilFadeAway.20220102.UNOFFICIAL
Create hunting rule

Xls.Dropper.EPPlus-9802867-2
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Changing an executable file
Launching a process
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Unauthorized injection to a recently created process
Running batch commands by exploiting the app vulnerability
Infecting executable files
Result
Verdict:
Malicious
File Type:
Excel File with Macro
Link:
https://app.docguard.net/7933ad4edab82e52f977bc9623aa7b24f63ac959efbf1cd5c8ecf73a4207b9c1/results/dashboard
Payload URLs
URL
File name
http://46.249.35.196/mid/Order1040258.exe
ThisWorkbook
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
certutil certutil.exe cmd macros macros-on-open
Link:
https://www.filescan.io/uploads/62bdc6e0b0578633c8b4cd77/reports/e8741ccd-9852-477b-be28-e89484bc610a/overview
Label:
Malicious
Suspicious Score:
9.9/10
Score Malicious:
1%
Score Benign:
0%
Link:
https://www.malware.ai/gui/files/?id=4be0e552-4167-40e8-8760-d010d8feafa9
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/7933ad4edab82e52f977bc9623aa7b24f63ac959efbf1cd5c8ecf73a4207b9c1
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
IPv4 Dotted Quad URL
A URL was detected referencing a direct IP address, as opposed to a domain name.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
InQuest Machine Learning
An InQuest machine-learning model classified this macro as potentially malicious.
Document With No Content
Document contains little or no semantic information.
Result
Threat name:
AgentTesla, AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1022713
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Contains functionality to register a low level keyboard hook
Document contains an embedded VBA macro which may execute processes
Document exploit detected (process start blacklist hit)
Drops PE files to the document folder of the user
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies the hosts file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AgentTesla
Yara detected AsyncRAT
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 655207 Sample: Order1040258.xlsm Startdate: 30/06/2022 Architecture: WINDOWS Score: 100 72 Snort IDS alert for network traffic 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 Antivirus detection for URL or domain 2->76 78 14 other signatures 2->78 9 EXCEL.EXE 53 14 2->9         started        12 Aeigqqh.exe 2->12         started        15 Aeigqqh.exe 2->15         started        process3 file4 52 C:\Users\user\Desktop\~$Order1040258.xlsm, data 9->52 dropped 17 cmd.exe 9->17         started        112 Multi AV Scanner detection for dropped file 12->112 114 Machine Learning detection for dropped file 12->114 116 Encrypted powershell cmdline option found 12->116 19 powershell.exe 12->19         started        21 powershell.exe 12->21         started        23 powershell.exe 15->23         started        signatures5 process6 process7 25 Agynyddjasev.exe.exe 14 9 17->25         started        29 certutil.exe 14 17->29         started        dnsIp8 54 C:\Users\user\AppData\Roaming\...\Aeigqqh.exe, PE32 25->54 dropped 56 C:\Users\user\AppData\...\Crstwuze5m.exe, PE32 25->56 dropped 96 Multi AV Scanner detection for dropped file 25->96 98 Machine Learning detection for dropped file 25->98 100 Encrypted powershell cmdline option found 25->100 110 2 other signatures 25->110 32 InstallUtil.exe 12 10 25->32         started        37 Crstwuze5m.exe 12 1 25->37         started        39 powershell.exe 7 25->39         started        41 powershell.exe 6 25->41         started        70 46.249.35.196, 49173, 49174, 49175 SERVERIUS-ASNL Netherlands 29->70 58 C:\Users\user\...\Agynyddjasev.exe.exe, PE32 29->58 dropped 60 C:\Users\user\AppData\...\Order1040258[1].exe, PE32 29->60 dropped 62 C:\Users\...\8886725A52D3C1A2789C0B989B8D35E4, PE32 29->62 dropped 102 System process connects to network (likely due to code injection or exploit) 29->102 104 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 29->104 106 Drops PE files to the document folder of the user 29->106 108 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 29->108 file9 signatures10 process11 dnsIp12 64 136.144.41.76, 49176, 49177, 49178 WORLDSTREAMNL Netherlands 32->64 50 C:\Windows\System32\drivers\etc\hosts, ASCII 32->50 dropped 80 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 32->80 82 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 32->82 84 Tries to steal Mail credentials (via file / registry access) 32->84 92 6 other signatures 32->92 86 Multi AV Scanner detection for dropped file 37->86 88 Machine Learning detection for dropped file 37->88 90 Encrypted powershell cmdline option found 37->90 94 2 other signatures 37->94 43 InstallUtil.exe 37->43         started        46 powershell.exe 37->46         started        48 powershell.exe 37->48         started        file13 signatures14 process15 dnsIp16 66 62.197.136.167, 49184, 8808 SPRINTLINKUS Netherlands 43->66 68 127.0.0.1 unknown unknown 43->68
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7933ad4edab82e52f977bc9623aa7b24f63ac959efbf1cd5c8ecf73a4207b9c1/
Threat name:
Script-Macro.Downloader.Powdow
Create hunting rule
Status:
Malicious
First seen:
2022-06-30 15:52:07 UTC
File Type:
Document
Extracted files:
26
AV detection:
15 of 26 (57.69%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pez22tw2xaxff6lxxslchkt3et3dvskz567rzvoi5t3tuqqhxhaq._file
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:asyncrat botnet:default collection keylogger persistence rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/220630-ta2jbaccgp/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Downloads MZ/PE file
Drops file in Drivers directory
Executes dropped EXE
Async RAT payload
AgentTesla
AsyncRat
Process spawned unexpected child process
suricata: ET MALWARE AgentTesla Communicating with CnC Server
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
Malware Config
C2 Extraction:
http://136.144.41.76/bray/inc/a4a9ffb236214a.php
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1111
62.197.136.167:6606
62.197.136.167:7707
62.197.136.167:8808
62.197.136.167:1111
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7933ad4edab8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7933ad4edab82e52f977bc9623aa7b24f63ac959efbf1cd5c8ecf73a4207b9c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:vbaproject_bin
Create hunting rule
Author:CD_R0M_
Description:{76 62 61 50 72 6f 6a 65 63 74 2e 62 69 6e} is hex for vbaproject.bin. Macros are often used by threat actors. Work in progress - Ran out of time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/284634/

Comments