MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 948ea22154ee7317baaf0e1ec07ce5193c7edaed53b46c62e8c8917e434f3b67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 948ea22154ee7317baaf0e1ec07ce5193c7edaed53b46c62e8c8917e434f3b67
SHA3-384 hash: e8b6183719aa94f5ebde45617afd20c26fc56fba499cd4517d0f985f7d06637f4d7a0bd5ad645a12f8c96492528359ab
SHA1 hash: 8410b8034526c360a7fd510ff558221ae5e2167e
MD5 hash: 6ea269c2c562e363b5a77df663888d26
humanhash: five-finch-nineteen-november
File name:6ea269c2c562e363b5a77df663888d26.dll
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:617'984 bytes
First seen:2025-04-23 17:48:52 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9191896ab94c9f4a5ddfd3869dda15d2 (1 x AsyncRAT)
ssdeep 12288:5GaR591gHaakICmHWudAtIRtnnOX4aT81GkxNMfXsdZADr7m0zkHs:JR57gHaakuH3AtuOXXTHGFdSH60G
TLSH T134D41211B4D0D571CABE653A4415C9698B6F3920DFD21CEB3380A6AF1F382C1ED3696B
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:AsyncRAT dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
461
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/3762/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.22222.7613.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68092a40a37ff28e1298c3ce
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm entropy microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/68092818833df795debc2279/reports/2fc4835d-de2c-4067-8fd5-c339c0448da6/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/948ea22154ee7317baaf0e1ec07ce5193c7edaed53b46c62e8c8917e434f3b67
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b9e633f0-788d-4179-8dfa-083b393e4aa4
Result
Threat name:
PureCrypter, AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1672379
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code contains very large strings
Creates an autostart registry key pointing to binary in C:\Windows
Detected PureCrypter Trojan
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal Bitcoin Wallet information
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1672379 Sample: XC57CWnMr0.dll Startdate: 23/04/2025 Architecture: WINDOWS Score: 100 27 verify-captcha.ru 2->27 29 bg.microsoft.map.fastly.net 2->29 33 Suricata IDS alerts for network traffic 2->33 35 Malicious sample detected (through community Yara rule) 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 5 other signatures 2->39 8 loaddll32.exe 1 2->8         started        10 rundll32.exe 2->10         started        12 rundll32.exe 2->12         started        signatures3 process4 process5 14 rundll32.exe 1 3 8->14         started        17 cmd.exe 1 8->17         started        19 rundll32.exe 2 8->19         started        21 conhost.exe 8->21         started        signatures6 47 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 14->47 49 Found many strings related to Crypto-Wallets (likely being stolen) 14->49 51 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->51 53 4 other signatures 14->53 23 rundll32.exe 1 2 17->23         started        process7 dnsIp8 31 45.141.233.236, 49687, 49693, 56001 ASDETUKhttpwwwheficedcomGB Bulgaria 23->31 41 System process connects to network (likely due to code injection or exploit) 23->41 43 Found many strings related to Crypto-Wallets (likely being stolen) 23->43 45 Tries to harvest and steal Bitcoin Wallet information 23->45 signatures9
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/948ea22154ee7317baaf0e1ec07ce5193c7edaed53b46c62e8c8917e434f3b67
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/948ea22154ee7317baaf0e1ec07ce5193c7edaed53b46c62e8c8917e434f3b67/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2025-04-22 18:17:00 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sshkeiku5zzrpovpbypma7hfde6h5wxnko2gyyxizcix4q2phntq._file
Verdict:
malicious
Label(s):
donut_injector
Create hunting rule
Similar samples:
error
AsyncRAT
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/250423-wd21csypz5/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Adds Run key to start application
Blocklisted process makes network request
Unpacked files
SH256 hash:
948ea22154ee7317baaf0e1ec07ce5193c7edaed53b46c62e8c8917e434f3b67
MD5 hash:
6ea269c2c562e363b5a77df663888d26
SHA1 hash:
8410b8034526c360a7fd510ff558221ae5e2167e
Link:
https://www.unpac.me/results/20c0aeb8-06c9-4352-b81d-ebb49da9ec59/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/948ea22154ee7317baaf0e1ec07ce5193c7edaed53b46c62e8c8917e434f3b67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/3762/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments