MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 16 File information Comments

SHA256 hash:	96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1
SHA3-384 hash:	c78b0dd43ed5c82ec080970ba479069fa7f6e513dd5fb4ff73274ebfb83dc0afa70257709596fbde00e0c53871bda6dc
SHA1 hash:	fe04a678f7d95ed31bd364e0a8a4831964f2b84f
MD5 hash:	d5489da5aa14ed9d71d8338ec41a1bc1
humanhash:	avocado-glucose-pip-west
File name:	rDoc5633276235623657_xls.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	86'528 bytes
First seen:	2024-09-26 11:24:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	1536:WGOLl+jxSwe51ZMXEw1PfEeRH0bndlu630VDx:WGOBCtE1ZpwJbSndTEVDx
TLSH	T11783190A3AC5C705D4E4BAF981F7591207A2BDD22231C24A6DF83B694E737A3ECC165D
TrID	66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	174f4559191b1b13 (81 x AgentTesla, 68 x Formbook, 34 x SnakeKeylogger)
Reporter	FXOLabs
Tags:	AsyncRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

487

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

rDoc5633276235623657_xls.exe

Verdict:

Malicious activity

Analysis date:

2024-09-26 11:27:26 UTC

Tags:

discord xworm remote

Link:

https://app.any.run/tasks/dee7fc74-6965-421b-b7dd-2235734fce73

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f54491c5ef4567b6c9c4ab

Tags:

Generic Network Static Stealth Underscore Autorun

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Launching a process

Creating a file

Creating a file in the %AppData% directory

Creating a window

Using the Windows Management Instrumentation requests

Creating a file in the %temp% directory

Reading critical registry keys

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

lolbin masquerade net_reactor obfuscated packed regasm

Link:

https://www.filescan.io/uploads/66f544989b2f79465c04e65b/reports/cb29cad4-7c32-421c-8e3e-c3e74b3fdd39/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

XWorm

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c23f2251-be9b-4725-81e8-5eba46ac1b96

Result

Threat name:

StormKitty, XWorm

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1519397

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected BrowserPasswordDump

Yara detected Generic Downloader

Yara detected StormKitty Stealer

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1/

Threat name:

Win32.Trojan.Znyonm

Status:

Malicious

First seen:

2024-09-26 12:05:22 UTC

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s3pksukrwrjqtwf5ueis7bbialuffik2yiltwabdwg5dlxvol3aq._file

Verdict:

malicious

Label(s):

xworm

dcrat

Result

Malware family:

xworm

Score:

10/10

Tags:

family:stormkitty family:xworm discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/240926-nh9xrsvapp/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Drops startup file

Loads dropped DLL

Reads user/profile data of web browsers

Detect Xworm Payload

StormKitty

StormKitty payload

Xworm

Malware Config

C2 Extraction:

178.215.236.218:16433

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e4a7ae9e-fb45-4740-a766-6f95db587949

Unpacked files

SH256 hash:

96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1

MD5 hash:

d5489da5aa14ed9d71d8338ec41a1bc1

SHA1 hash:

fe04a678f7d95ed31bd364e0a8a4831964f2b84f

Detections:

PureCrypter_Stage1

SUSP_OBF_NET_Reactor_Indicators_Jan24

SUSP_PE_Discord_Attachment_Oct21_1

Link:

https://www.unpac.me/results/3535c532-271f-4f75-8a84-b57c82477103/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/96dea95151b4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AgentTesla Create hunting rule
Author:	Harish Kumar P
Description:	Yara Rule to Detect AgentTesla

Rule name:	BAZT_B5_NOCEXInvalidStream Create hunting rule

Rule name:	DotNet_Reactor Create hunting rule
Author:	@bartblaze
Description:	Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	PureCrypter Create hunting rule
Author:	@bartblaze
Description:	Identifies PureCrypter, .NET loader and obfuscator.
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_Discord_Attachments_URL Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads

Rule name:	SUSP_PE_Discord_Attachment_Oct21_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:	Internal Research

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

exe 96dea95151b45309d8bda1112f842802e852a15ac2173b0023b1ba35deae5ec1

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample