MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 4 File information Comments

SHA256 hash:	8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942
SHA3-384 hash:	90d438d0c34fcc25334719c8914abe8b1a614c1b9122076fd5a1aeb7e97a45fe86c8a7b669809939266a536921777feb
SHA1 hash:	0466b3502a2f977743e58bac2bbd8abb916b12fe
MD5 hash:	5e70b3aa3c9273b75a2c3d08b89decef
humanhash:	london-east-fix-failed
File name:	ORDER_LI.LNK
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	3'660 bytes
First seen:	2021-06-07 05:37:22 UTC
Last seen:	Never
File type:	lnk
MIME type:	application/octet-stream
ssdeep	48:89Ha47ikvAh1ZxUy9wRtgCqgh6a8ojaOCGXgIZabM:89H6MAhDxUgw7qgZjLg2
TLSH	C171701852E99309F2F6EB35A9FE6223F5627E66F612CA6D1083424905B0104F8DBF3D
Reporter	0x3c7
Tags:	AsyncRAT crime lnk RAT

Intelligence

File Origin

# of uploads :

# of downloads :

156

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

MALICIOUS

Details

Hidden Powershell

Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942/

Threat name:

Shortcut.Trojan.Wacatac

Status:

Malicious

First seen:

2021-06-01 22:58:14 UTC

AV detection:

11 of 29 (37.93%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r7d7exnjksw4xd4r2wyodft6jkimuezlfafknltt4filkxjqdfba._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_generic_LNK_uid_Jun2021_1 Create hunting rule
Author:	Nils Kuhnert
Description:	Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.

Rule name:	EXE_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies executable artefacts in shortcut (LNK) files.

Rule name:	Long_RelativePath_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.