MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b642f238c7158c3129dccf6141b8fb8709834ce01bed0f04da6ef80d70f1cd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b642f238c7158c3129dccf6141b8fb8709834ce01bed0f04da6ef80d70f1cd8
SHA3-384 hash: 1daed4f4815aec998b5f2fe63c001b577f23da5ae847c59e25902e8f30a39bc8373e0e44a96bd11c2b1cfbdf3472c7dd
SHA1 hash: 3a2ac61527bc98b6f63c474fb0b0628b2876e859
MD5 hash: fedc726e9e82f36866054c42e40dc01f
humanhash: muppet-mississippi-mississippi-neptune
File name:regedit.dll
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:286'208 bytes
First seen:2023-01-30 02:12:17 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 3072:mzAqsjXBXBqf6ura3Rx7+HHgmIKxUI0oWFcgboxW5d52kuoXxweMSfb/FM:0uRRtL2HgmmoscZW52j6weMSJ
Threatray 2'299 similar samples on MalwareBazaar
TLSH T11F542B006FECC717EABE23F5D87915088BF5F51AF61AE74A58A420F90C127846A117BF
TrID 35.4% (.EXE) Win64 Executable (generic) (10523/12/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4505/5/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter adm1n_usa32
Tags:AsyncRAT dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
199
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/358070/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
dcrat greyware
Link:
https://www.filescan.io/uploads/63d727b096add6d1cf4927e2/reports/8c5eb2a6-58bc-4eaa-bc9b-339c88e2dd6e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/489008c4-b9b6-4357-a145-6fbf0dd65006
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1161233
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 793970 Sample: regedit.dll Startdate: 30/01/2023 Architecture: WINDOWS Score: 56 15 Antivirus / Scanner detection for submitted sample 2->15 17 Multi AV Scanner detection for submitted file 2->17 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b642f238c7158c3129dccf6141b8fb8709834ce01bed0f04da6ef80d70f1cd8/
Threat name:
ByteCode-MSIL.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2023-01-25 13:30:00 UTC
File Type:
PE (.Net Dll)
AV detection:
23 of 39 (58.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tnsc6i4mofmmgeu5zt3big4pxbyjqngoag7nb4cnu3xybvypdtma._file
Verdict:
malicious
Similar samples:
0e9445775af2f2377469ccf463ffae76290f74ad6bfa324cbb0b156d971bc32b
AsyncRAT
18271c11925b94e6310672889885575ab4786e36a4c404e478accf3cb24172be
AsyncRAT
79c88080262db1ffc03376d9a98fe8ba71508b03c4f2a28af50f53b8aa235bf9
AsyncRAT
7f9558b222b78098c76f84c190fb28848c2f8e2e89cabfd7eb3ba83a6160c96d
AsyncRAT
8df28341644c2139c9d9dfb6231169c70fdb5a18daf628bac6307503f4d0b80f
AsyncRAT
a7d8154bb436ed2e91516ab13e82aaee5f76e9af2d16d6ce62758aa3c17f0b3e
AsyncRAT
cf6b35a3db282f36cb1f6a32c4c4d15185c21960ec672e0716de24b40df8f48b
AsyncRAT
d329a265d4005b2cb8902d6148ff5e4477f2203bc2e476e51e5895f9be99c53e
AsyncRAT
e94c60401db37f29856ef538b58ed29e951d37c746a551b1b62fe6f05672087d
AsyncRAT
+ 2'289 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/230130-cneg9seh7z/
Unpacked files
SH256 hash:
9b642f238c7158c3129dccf6141b8fb8709834ce01bed0f04da6ef80d70f1cd8
MD5 hash:
fedc726e9e82f36866054c42e40dc01f
SHA1 hash:
3a2ac61527bc98b6f63c474fb0b0628b2876e859
Link:
https://www.unpac.me/results/2f340f44-917d-4e50-9b97-be575034db74/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9b642f238c7158c3129dccf6141b8fb8709834ce01bed0f04da6ef80d70f1cd8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/358070/

Comments