MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7caf87ac1666f10cbbff4cc01d51ec4df556908b2d8d55d5c4f0f3724dceded1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	7caf87ac1666f10cbbff4cc01d51ec4df556908b2d8d55d5c4f0f3724dceded1
SHA3-384 hash:	4d21ec17205c6310962a6e9599c5ba7824f3be30fbb30c663de275e0e9b2d4dec5aa3f4ea2dcd8620c55058ab4cbb431
SHA1 hash:	acdaeab40a2e440dd5ce423691f1b6518cfbc384
MD5 hash:	b31f2aa47951a02730a10ffb57c0012b
humanhash:	lake-charlie-neptune-echo
File name:	454425 new index-payment reminder.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	635'904 bytes
First seen:	2020-06-15 13:48:10 UTC
Last seen:	2020-06-15 15:26:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'614 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:iaUPSy6VEJD6LpL9aQoblj27yGLUCa8FDbtUhB8wNHVi2dpgaUIVdrjc:iaUd6VEt6z3A2jLFjFUhB1HVx1JVe
Threatray	416 similar samples on MalwareBazaar
TLSH	E0D4C063F5059073D4294A728197C3A00EB7AD7AFBC16B4B2598332E7E7354B633361A
Reporter	abuse_ch
Tags:	AsyncRAT exe nVpn RAT

abuse_ch

Malspam distributing AsyncRAT:

HELO: belgium-mep.com
Sending IP: 185.234.219.109
From: Belgium Electromechanical Works <info@belgium-mep.com>
Subject: Re: RE: new index-payment reminder
Attachment: 454425 new index-payment reminder.rar (contains "454425 new index-payment reminder.exe")

AsyncRAT C2:
194.5.98.129:5554

Hosted on nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.98.0 - 194.5.98.255
netname: Privacy_Online
descr: Longyearbyen, Svalbard und Jan Mayen
country: SJ
admin-c: RA9926-RIPE
tech-c: RA9926-RIPE
org: ORG-NFAS6-RIPE
status: ASSIGNED PA
mnt-by: inter-cloud-mnt
created: 2019-04-26T16:42:54Z
last-modified: 2020-03-13T23:11:55Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/10472/

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.67575.12567.30707.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-15 13:50:05 UTC

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=psxyplawm3yqzo77jtab2upmjx2vneelfwgvlvoe6dzxetoo33iq._file

Verdict:

suspicious

Result

Malware family:

asyncrat

Score:

10/10

Tags:

family:asyncrat agilenet rat

Link:

https://tria.ge/reports/201109-8xpm73lfea/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

Async RAT payload

AsyncRat

Malware Config

C2 Extraction:

194.5.98.129:5554
:5554

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.