MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96fa5508157c3e0b18ccaa02417198c62816e549791997efd29dbcb8801e0db0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96fa5508157c3e0b18ccaa02417198c62816e549791997efd29dbcb8801e0db0
SHA3-384 hash: ab0897a06a879232d708cc0ba5e6654660634d5d544ff5e3e4a08fd11e2805b8995164ce64b69f0bac6bc658777dcefb
SHA1 hash: 3fcccc878f029e37d17c7124b6b06d869ebc0a4b
MD5 hash: 7714485973a54407bd021a4682ee7f1b
humanhash: july-batman-mike-item
File name:vergi ödemesi dekontu 26.10.2021,pdf.vbs
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'066 bytes
First seen:2021-10-26 13:07:09 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 24:mV4UvXPc6BJjK0xAU5iexBFN0oFnfH+8C:s4eUsK0xARe4Yng
Threatray 158 similar samples on MalwareBazaar
TLSH T12411E122DC57FFE30925E795A0C855EEC1F894C447D44CBC1089344A28FE4792A9D8B1
Reporter abuse_ch
Tags:AsyncRAT geo TUR vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AgentTeslaV3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200232/
Detection(s):
SecuriteInfo.com.ISB.Downloadergen44.8954.1931.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
75%
Tags:
powershell
Link:
https://www.filescan.io/uploads/6177fdb4db358dd15edc9200/reports/209f681d-cfe4-4848-b53a-ab046f3827d9/overview
Result
Verdict:
SUSPICIOUS
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/877249
Signature
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Suspicious PowerShell Command Line
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96fa5508157c3e0b18ccaa02417198c62816e549791997efd29dbcb8801e0db0/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2021-10-26 07:52:22 UTC
AV detection:
11 of 44 (25.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s35fkcavpq7awggmvibec4myyyubnzkjpemzp36stw6lraa6bwya._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
043624c213f4575f22c66f72f20dd68a1126363beefd8d1c7c5c0d82a5a556ce
AsyncRAT
3959233284f7f4a7bec2a314820e3b8e073591a31dfe8c43a03f7a24833b7fd3
AsyncRAT
3fc706ce01f2ff41e02943699351d1ad3c32160cbd0be0b8bb85f9472303d4c2
AsyncRAT
6d392e6956913772c10d49c5a64933b5bbc17d66a8ce02e5ed6716141af438ed
AsyncRAT
a341b8f10a51457c11292173cfa48fe49256c9ccef8ec045753b49b2bfa935d6
AsyncRAT
b24993e503f1ba6774ff88faebc3487bfece018b3baac4b0ada076d7f86ef26d
AsyncRAT
c3f8019ba1f837f109cf75b3aeb84e79900030e8f098302490dd7bca4d2345b0
AsyncRAT
caf35ea9298dd671604af5920dccb89362fee4a67b24f8bfe73e12ceedc91504
AsyncRAT
eb30ab0173d9def4895227fbc1f82c21bbd7af6209d268a483c57e5ee04926b3
AsyncRAT
+ 148 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/211026-qc774ahed5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Blocklisted process makes network request
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
Officialsw.chickenkiller.com:2101
official.ydns.eu:2101
hurricane.ydns.eu:2101
Dropper Extraction:
https://cdn.discordapp.com/attachments/902439563757256777/902444892234612776/bypass.txt
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/96fa5508157c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96fa5508157c3e0b18ccaa02417198c62816e549791997efd29dbcb8801e0db0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/200232/

Comments