MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 795457d15ba9fbfbeb37566059765527e896229bd7062243f5bc66bef056e23a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	795457d15ba9fbfbeb37566059765527e896229bd7062243f5bc66bef056e23a
SHA3-384 hash:	978b415af395476b3f3197e2670daf65d09c6888af2af6e4beb6064b6f30bf91c55541b1401bb09375c5beb0559942d1
SHA1 hash:	d31fe82c85a52f91217ae123c5f2829ffa46189e
MD5 hash:	c4fdab24038e4e494d990dcf092df002
humanhash:	happy-quiet-lemon-violet
File name:	Doc#66202009475352576539000.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	1'180'160 bytes
First seen:	2020-06-18 17:22:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	24576:Vtb20pkaCqT5TBWgNQ7a5Zy01SWCqXexMMgRf16A:GVg5tQ7a5ENSTFR95
Threatray	1'174 similar samples on MalwareBazaar
TLSH	B9457C0263BEC21EC6714137E65E22015EAABD31466BBD5EEE943E3D5630263F119F32
Reporter	abuse_ch
Tags:	AsyncRAT exe

abuse_ch

Malspam distributing AsyncRAT:

HELO: rt.plasticmold-parts.com
Sending IP: 208.123.119.131
From: Purchase <purchase@arabico.ae>
Subject: URGENT QUOTATION - arabico company dubai
Attachment: Doc66202009475352576539000.zip (contains "Doc#66202009475352576539000.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Gathering data

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pfkfpuk3vh57x2zxkzqfs5sve7ujmiu324dceq7vxrtl54cw4i5a._file

Verdict:

malicious

AsyncRAT

356d866f274623590c024a10727dc8cb49a79215b671cebe0e64a406cc0e7b77

AsyncRAT

5f0f76108593d7ecc8a5932e244c0168947b173bf24369ced9793f9a034d04c5

AsyncRAT

69a72a4e6627e9d4f81f2a4a7d83438fa05301a909093a2e86284d2bd3f9bbaf

AsyncRAT

80f56695aceb9a29286d4ca72ca2d54c02aeb3e2f22167392306701ed91a281e

AsyncRAT

96e185894358d0c8c7f977fa2a586e6cf9e6e71ed2d6d23081633cd9d19c5367

AsyncRAT

a209c7f61f9087bae76108a3e938928025d64697d019db780bf5ef46e20c34c7

AsyncRAT

b2be5f08e09f2914078a7d86beb201f7ae77e51e2134f32446b0b2c2d97e5b57

AsyncRAT

b6b19634b174ec68dacf4a4f936d8ad91e4374737de56f1e3995b51f778f755b

AsyncRAT

c2d6a58ae4cc93b225f512a127c751c63398d0fdb7f847b77c83cad6cb79e6bd

AsyncRAT

+ 1'164 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/200624-8m1evhgqjx/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Legitimate hosting services abused for malware hosting/C2

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.