MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ec599424a161fe942345c2336dd0cfb8c7d64e6e72b8e90efd999328b06cc04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ec599424a161fe942345c2336dd0cfb8c7d64e6e72b8e90efd999328b06cc04
SHA3-384 hash: 1b6c631a1f336cd6bc55bfc598a0dc2df5cc79e29866d48c99d98843a5bf94194cf8477ddfdcf90e04889b56a661af07
SHA1 hash: c81325baa06f4bc155afd16e53d30a46dce88a54
MD5 hash: 3ef95c13b22fdd5660724c4232bee2c7
humanhash: skylark-beryllium-october-table
File name:7ec599424a161fe942345c2336dd0cfb8c7d64e6e72b8e90efd999328b06cc04
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'181'184 bytes
First seen:2020-06-10 07:37:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 79 x RedLineStealer)
ssdeep 24576:dEbvh2Li15iVHC6u+xmedEsx71HuUbCSDpDHY7NylJliZzjDRC:d84Li15Ui6ssx71OUW+pDHMyl8RC
Threatray 27 similar samples on MalwareBazaar
TLSH F44533F99344D221E4B11836A72B2CF59AAE84C8F4F67F99D33F37ADCA32554D492042
Reporter JAMESWT_WT
Tags:AsyncRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Enigma
Create hunting rule
Status:
Malicious
First seen:
2020-06-05 13:25:27 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p3czsqskcyp6sqrulqrtnxim7ogh2zhg44vy5ehp3gmtfcygzqca._file
Verdict:
suspicious
Similar samples:
34e142c3ca75844c48639cfc8f60513d23c02a65addef3bce69f5b49b34277a1
AsyncRAT
45e9959441e6e30c4c7a4dd8b3d56b88ad09d2ad253851ea79be62ec9c1c8f68
AsyncRAT
54488d42558df58d9694b6a6150e4934c045c588566be3a555c005ce0aa4ab39
AsyncRAT
5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7
AsyncRAT
5ef8714caf9c7296847b67b27edb93c3aec23d7e77b57d23d0e8607d707a2c49
AsyncRAT
5fc42d8d65da12afe624f5b959b3318a808fe18640d497fa5ed7530748e7935a
AsyncRAT
6c90f16a6932be921cbb44b9e4531cf36e5ded6d5dd0016c4309a56ab8a96461
AsyncRAT
85d879be258470ed22d55bb6fda8be5d0b7d480c23d95b252516e85ccad2fec4
AsyncRAT
88e03236b248d004923161c7928a1546cdffd0b6e8c30a22b1d49b05dca9b2da
AsyncRAT
e24f69aa8738d14b85ad76a1783d51120b8b6ba467190fe7d8f96ad2969c8fdf
AsyncRAT
+ 17 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat persistence rat
Link:
https://tria.ge/reports/201109-w5m5ys71jn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
rapraprat.duckdns.org:43210
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments