MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b6d6d51a0032be0ac9c3b857065a2ba87caa96dac3d0023d8819eb3baa6dd8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b6d6d51a0032be0ac9c3b857065a2ba87caa96dac3d0023d8819eb3baa6dd8c
SHA3-384 hash: b84d08fc95564ef396053d48c39b9b705ca78d91d6f40265adcb2037300aaf8a63d0ad7e8d71e0d60be30a2a1a831f99
SHA1 hash: e6d9435df4b136ceac144b84ec9b8fa7cfead13a
MD5 hash: c7b73269543ae666701b2d97172b93fb
humanhash: fanta-march-eight-echo
File name:Leer Documento.vbs
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:24'267'128 bytes
First seen:2024-08-08 17:14:48 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 1536:VPadPlP4PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPm:8v
TLSH T19137F01735A401057CF2E98AA5621170C726BACED97F8CABC5E3C45984ECE509FA0FE7
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Reporter ramirezrick2
Tags:AsyncRAT DCRat vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.GT.VB.Honolulu.1.FCA631BB.4111.5988.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66b4fd1ab35234d5cc65b760
Tags:
Encryption Execution Network Stealth
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/66b4fd18a0a45bee63128152/reports/3a9ff3c0-860c-46de-8355-0353a21a5399/overview
Verdict:
Malicious
Labled as:
GT:VB.Honolulu.1
Link:
https://www.hybrid-analysis.com/sample/7b6d6d51a0032be0ac9c3b857065a2ba87caa96dac3d0023d8819eb3baa6dd8c
Result
Verdict:
MALICIOUS
Result
Threat name:
AsyncRAT, DcRat
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1490136
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AsyncRAT
Yara detected DcRat
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1490136 Sample: Leer Documento.vbs Startdate: 08/08/2024 Architecture: WINDOWS Score: 100 24 zorra123.duckdns.org 2->24 26 bbuseruploads.s3.amazonaws.com 2->26 28 4 other IPs or domains 2->28 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Yara detected DcRat 2->46 50 10 other signatures 2->50 9 wscript.exe 1 2->9         started        signatures3 48 Uses dynamic DNS services 24->48 process4 signatures5 52 Suspicious powershell command line found 9->52 54 Wscript starts Powershell (via cmd or directly) 9->54 56 Windows Scripting host queries suspicious COM object (likely to drop second stage) 9->56 58 Suspicious execution chain found 9->58 12 powershell.exe 7 9->12         started        process6 signatures7 60 Suspicious powershell command line found 12->60 62 Found suspicious powershell code related to unpacking or dynamic code loading 12->62 15 powershell.exe 14 15 12->15         started        19 conhost.exe 12->19         started        process8 dnsIp9 32 bitbucket.org 185.166.143.50, 443, 49713 AMAZON-02US Germany 15->32 34 s3-w.us-east-1.amazonaws.com 54.231.133.137, 443, 49714 AMAZON-02US United States 15->34 36 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 15->36 38 Writes to foreign memory regions 15->38 40 Injects a PE file into a foreign processes 15->40 21 RegSvcs.exe 1 2 15->21         started        signatures10 process11 dnsIp12 30 zorra123.duckdns.org 181.235.3.72, 2020, 49716 COLOMBIATELECOMUNICACIONESSAESPCO Colombia 21->30
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7b6d6d51a0032be0ac9c3b857065a2ba87caa96dac3d0023d8819eb3baa6dd8c
Gathering data
Threat name:
Script-WScript.Trojan.Honolulu
Create hunting rule
Status:
Malicious
First seen:
2024-08-08 17:15:09 UTC
File Type:
Text (VBS)
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pnww2unaamv6ble4hocxazncxkd4vklnvq6qai6yqgplhovg3wga._file
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default discovery execution rat
Link:
https://tria.ge/reports/240809-k47srayfkr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Command and Scripting Interpreter: PowerShell
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Blocklisted process makes network request
AsyncRat
Malware Config
C2 Extraction:
zorra123.duckdns.org:2020
Dropper Extraction:
https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fdll%20Hope.txt?alt=media&token=61c829f6-e196-49e8-b4ff-041134577ffe
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b6d6d51a0032be0ac9c3b857065a2ba87caa96dac3d0023d8819eb3baa6dd8c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

Visual Basic Script (vbs) vbs 7b6d6d51a0032be0ac9c3b857065a2ba87caa96dac3d0023d8819eb3baa6dd8c

(this sample)

Joe
Joe Sandbox
https://www.joesandbox.com/analysis/1490136/0/html
  
Delivery method
Distributed via e-mail attachment

Comments