MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126
SHA3-384 hash: 9e89a29a00f9b92b8824ea37a8a751d86dde0c50f51dd3ce39b80c5968ae67a461a03b9396d31ff7a355bb65f9fcb7f0
SHA1 hash: 937fbc8336a399f3a52b3f402e3f21743e99475d
MD5 hash: ea64f932d1a2f1c8d7df9887c89930ef
humanhash: stairway-double-spring-mobile
File name:ea64f932d1a2f1c8d7df9887c89930ef.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'299'968 bytes
First seen:2025-01-29 15:40:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 24576:CZZQ/5dwPBMCeg2TF8tEwCC2byS2s9AZzaq+8ABIAjuvuBbrtbf0zpuVGmhDUDSG:Cg8JMSOyqwHzSxsaX8lIukrB0zpMkv
TLSH T1DB55021A524D8611C7F90733E44ED0648F78B9D2E78AABDEA5ACA1F81EC370790D127D
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
File icon (PE):PE icon
dhash icon 71cc9cbaa296cc71 (1 x AsyncRAT)
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
172.93.218.10:8808

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
172.93.218.10:8808 https://threatfox.abuse.ch/ioc/1395966/

Intelligence

File Origin
# of uploads :
1
# of downloads :
543
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126.exe
Verdict:
Malicious activity
Analysis date:
2025-01-30 06:14:45 UTC
Tags:
purecrypter netreactor asyncrat
Link:
https://app.any.run/tasks/23909d9d-0276-4cf2-b09a-63d9bcb4dd2a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.10419.20345.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=679a4f2c39cd5095f12b5d3c
Tags:
autorun virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% directory
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bd97930c-58dd-4cfd-999f-bd919cf402df
Result
Threat name:
AsyncRAT, PureLog Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1602272
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Costura Assembly Loader
Yara detected PureLog Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1602272 Sample: hhBiOo7cA7.exe Startdate: 29/01/2025 Architecture: WINDOWS Score: 100 28 penoncaminosdel.gotdns.ch 2->28 40 Suricata IDS alerts for network traffic 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected PureLog Stealer 2->44 46 10 other signatures 2->46 8 hhBiOo7cA7.exe 5 2->8         started        12 wscript.exe 1 2->12         started        signatures3 process4 file5 22 C:\Users\user\AppData\Roaming\Keywords.exe, PE32 8->22 dropped 24 C:\Users\user\AppData\...\Keywords.vbs, ASCII 8->24 dropped 26 C:\Users\...\Keywords.exe:Zone.Identifier, ASCII 8->26 dropped 48 Drops VBS files to the startup folder 8->48 50 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 8->50 52 Writes to foreign memory regions 8->52 54 Injects a PE file into a foreign processes 8->54 14 aspnet_compiler.exe 2 8->14         started        56 Windows Scripting host queries suspicious COM object (likely to drop second stage) 12->56 17 Keywords.exe 2 12->17         started        signatures6 process7 dnsIp8 30 penoncaminosdel.gotdns.ch 172.93.218.10, 1025, 49737 SNEAKER-SERVERUS United States 14->30 32 Multi AV Scanner detection for dropped file 17->32 34 Machine Learning detection for dropped file 17->34 36 Writes to foreign memory regions 17->36 38 Injects a PE file into a foreign processes 17->38 20 aspnet_compiler.exe 3 17->20         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126/
Threat name:
ByteCode-MSIL.Trojan.Seraph
Create hunting rule
Status:
Malicious
First seen:
2025-01-23 06:37:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6f7t2ldgefjp56ljd5ntrdlzu66oiq6mresmp3ysnvllfx26eta._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/250129-s4rqjazrdq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Drops startup file
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3d29c627-810a-4b50-8b25-28b9916ca5ce
Unpacked files
SH256 hash:
878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126
MD5 hash:
ea64f932d1a2f1c8d7df9887c89930ef
SHA1 hash:
937fbc8336a399f3a52b3f402e3f21743e99475d
Link:
https://www.unpac.me/results/6f0c1884-2574-4a57-aa4f-d69c27457afd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/878bf9e96331/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/878bf9e963310a97f7cb48fad9c46bcd3de7221e6449263f78936ab596faf126

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments