MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c911b4d457b1b6124a1211cd4737c056e9a12dc930a05edfe7289cbed11e86c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c911b4d457b1b6124a1211cd4737c056e9a12dc930a05edfe7289cbed11e86c
SHA3-384 hash: 92f577c7ac00e7f4b06d3a05ff033b4ab7f7a6e4c78927a2cba11aee8e5b27107bb3e3943606f5c065a2167e6bdfe5e5
SHA1 hash: 01facbf9132aea6e12300d19119f434a7079f8f0
MD5 hash: f41a14859f324f4b208163475c347837
humanhash: zulu-iowa-football-queen
File name:genio.doc
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:61'294 bytes
First seen:2020-10-06 05:53:28 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 1536:cBL6lQSyYNKxqLpLq/wQQTepXAeoJiU1TlNd:inSB8qLpLqMJiU1d
TLSH 0253D0A8EF5C7B00CDE22978C21D65F0A303C9E66D75AA5E4B34F56AD6E3C291113B0D
Reporter abuse_ch
Tags:AsyncRAT doc RAT


Avatar
abuse_ch
Malspam distributing AsyncRAT:

HELO: smtp131t7f79.saaspmta0001.correio.biz
Sending IP: 179.188.7.79
From: Gloria Vasconcelos <antjod@terra.com.br>
Reply-To: antjod@terra.com.br
Subject: Roomlist
Attachment: genio.doc

AsyncRAT payload URL:
https://raw.githubusercontent.com/farao15/jj/master/Upload.jpg

AsyncRAT C2:
mika201.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/482319
Signature
Creates processes via WMI
Document contains an embedded VBA macro which may execute processes
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Obfuscated command line found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c911b4d457b1b6124a1211cd4737c056e9a12dc930a05edfe7289cbed11e86c/
Threat name:
Script-Macro.Trojan.Powload
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 01:32:24 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=psirwtkfpmnwcjfbeeoni434avxjuew4smfal3p6oke4x3ir5bwa._file
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
rat family:asyncrat
Link:
https://tria.ge/reports/201006-fsy4esz65x/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Office loads VBA resources, possible macro or embedded object present
Drops file in System32 directory
Suspicious use of SetThreadContext
Blacklisted process makes network request
Async RAT payload
AsyncRat
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://raw.githubusercontent.com/farao15/jj/master/fina.jpg
https://raw.githubusercontent.com/farao15/jj/master/Upload.jpg
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c911b4d457b1b6124a1211cd4737c056e9a12dc930a05edfe7289cbed11e86c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

Word file doc 7c911b4d457b1b6124a1211cd4737c056e9a12dc930a05edfe7289cbed11e86c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/658499/
  
Delivery method
Distributed via e-mail attachment

Comments