MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara 1 Comments

SHA256 hash: 9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74
SHA3-384 hash: d08636cace134b8be72fbce07d521ad7b7df2cd1c63ecf1812df3e9b06da40df06b2fc8aa8ab1543abcdd5bba249734a
SHA1 hash: 1de0d09d5731ee580de782ab6a090997a5403b46
MD5 hash: 1415244fa17fe0a50a7868e4b3984c39
humanhash: georgia-connecticut-moon-hamper
File name:9961dbd5a5bab309bcb5b9ba4bdb33859ad01d03cebf2690dfe1a9c8746d6a74
Download: download sample
Signature AsyncRAT
File size:188'416 bytes
First seen:2020-06-29 07:35:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 3072:P+eghdZSHUBO8wozCLYQcBOdXKrXHqFTXUH+NEMFwTcadj0AI:3ghdEPUeMfw87QT/NEMOTcOjs
TLSH 9E04AD0A3B9CE627C67D19F698D21B4413F659BB6242F7DE6CC061A424C37F58A223C7
Reporter @JAMESWT_MHT
Tags:AsyncRAT

Intelligence


File Origin
# of uploads :
1
# of downloads :
22
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-06-25 07:07:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level
  5/5
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext

Yara Signatures


Rule name:win_asyncrat_j1
Author:Johannes Bader @viql
Description:detects AsyncRAT

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments