MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93597692b4a1f822bb50f3030a10f46fd692940c101a5314cf5e6f0359c12d08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93597692b4a1f822bb50f3030a10f46fd692940c101a5314cf5e6f0359c12d08
SHA3-384 hash: 2dbca0da08837b21e409e3f95575b70fd31d82cfa0cafc22b10451fa586552a310971c66b25bfa29ca8527893f18f626
SHA1 hash: 99aa0edb5825ab683f1cf94e59b38c25ca5ce892
MD5 hash: 22b7f742553d9bf6d843a3ae5a2cd3e8
humanhash: triple-nevada-monkey-equal
File name:Project Al Ain (Hilli & Al Fou�ah) Parks.rar
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:170'911 bytes
First seen:2024-06-19 13:34:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:uNnLf3E54bIRMbo/+rOlnkv+zb3qvxEyDhWVAMv0/Ua/yHP7NZzX:u5fU5QeMbjrOlnkGbOEy9YAMc/UEk5tX
TLSH T135F3228D08A61B0BE3813DA89DAA0D65047A09EE9DE455FFEC0DDBBD3760A7C6CF4111
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:AsyncRAT rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Eng.David Isravel <vidIsravel@srigroup.co.jp>" (likely spoofed)
Received: "from [93.185.159.87] (unknown [93.185.159.87]) "
Date: "19 Jun 2024 04:00:35 -0700"
Subject: "=?UTF-8?B?UmVxdWVzdCBRdW90YXRpb24gZm9yIFBhcmtzIC0gKEpPQiBJTiBIQU5EKSBQcm9qZWN0IDogQWwgQWluIChIaWxsaSAmIEFsIEZvdeKAmWFoKSBQYXJrcw==?="
Attachment: "Project Al Ain (Hilli & Al Fou�ah) Parks.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Project Al Ain (Hilli & Al Fou’ah) Parks.vbe
File size:280'820 bytes
SHA256 hash: 6513f2777a217402f9fa6196dacc31c948dfdde0680ccba57879b1c8d2cd11f8
MD5 hash: ffe9b9de145969a32320dbbfa6dd5fe6
MIME type:text/plain
Signature AsyncRAT
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93597692b4a1f822bb50f3030a10f46fd692940c101a5314cf5e6f0359c12d08/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-06-19 12:51:06 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=snmxnevuuh4cfo2q6mbquehun7ljffamcanfgfgplzxqgwobfuea._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm rat trojan
Link:
https://tria.ge/reports/240619-tlsesaxgqj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Detect Xworm Payload
Xworm
Malware Config
C2 Extraction:
193.161.193.99:22849
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AsyncRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93597692b4a1f822bb50f3030a10f46fd692940c101a5314cf5e6f0359c12d08

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Windows_Generic_Threat_dbae6542
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

rar 93597692b4a1f822bb50f3030a10f46fd692940c101a5314cf5e6f0359c12d08

(this sample)

AsyncRAT

Visual Basic Script (vbe) vbe 6513f2777a217402f9fa6196dacc31c948dfdde0680ccba57879b1c8d2cd11f8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6513f2777a217402f9fa6196dacc31c948dfdde0680ccba57879b1c8d2cd11f8
  
Dropping
MD5 ffe9b9de145969a32320dbbfa6dd5fe6

Comments