MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972
SHA3-384 hash: 91f4e46fc023564e72d9c80b3a332f56a2f0b23142e666a05ca9166872c16d64e04cd51c9da002a2eb5f011007692e71
SHA1 hash: 2f8edacb5d2ec764056e8ebbea1d6dbd8261a100
MD5 hash: a7f39a5fb34ce604deeccf9114134280
humanhash: seventeen-fix-lactose-seven
File name:Specifications.doc.scr
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:371'200 bytes
First seen:2021-10-14 10:00:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:dmkzvwPJUIaMsnhwq+YOLNaRgwGPUv1JC9oIEMQ/AXUlQGK5rZx4G/rfyAI:QcwPJISq+7LNaRpTIXTcNK5T4G/rD
Threatray 1'674 similar samples on MalwareBazaar
TLSH T1D9846C3BF65A5A82D3AB2530C1E3512487E29C862233FA073B8935870D6379BFC5B5D5
File icon (PE):PE icon
dhash icon 30868a8c8c8e8230 (1 x AsyncRAT)
Reporter abuse_ch
Tags:AsyncRAT exe RAT scr

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197475/
Detection(s):
SecuriteInfo.com.Variant.Johnnie.3732.23821.12790.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Creating a file in the %temp% directory
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6167ffab1c2d58ba74063323/reports/8b66d1c7-0656-45b1-9d17-78934754feb4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/685ac81c-f996-49cb-91bc-4d5a72a2fc34
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/870327
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops PE files to the startup folder
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Powershell drops PE file
Sigma detected: Suspicious Double Extension
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 502755 Sample: Specifications.doc.scr Startdate: 14/10/2021 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->33 35 Found malware configuration 2->35 37 Antivirus detection for dropped file 2->37 39 7 other signatures 2->39 7 Specifications.doc.exe 1 2->7         started        10 Systems.exe 1 2->10         started        process3 file4 23 C:\Users\user\...\Specifications.doc.exe.log, ASCII 7->23 dropped 12 powershell.exe 15 7->12         started        16 Specifications.doc.exe 2 7->16         started        19 Systems.exe 2 10->19         started        process5 dnsIp6 25 C:\Users\user\AppData\Roaming\...\Systems.exe, PE32 12->25 dropped 27 C:\Users\user\...\Systems.exe:Zone.Identifier, ASCII 12->27 dropped 41 Drops PE files to the startup folder 12->41 43 Powershell drops PE file 12->43 21 conhost.exe 12->21         started        29 194.5.97.212, 1199, 49752 DANILENKODE Netherlands 16->29 31 192.168.2.1 unknown unknown 16->31 file7 signatures8 process9
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972/
Threat name:
Win32.Trojan.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2021-10-14 10:00:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=twkrxgicjipb7rhrcuep3pv6txwsbdhlxuyk77ggsfgdcvahzfza._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
04d4a1e49ed08a185a7c7930ce6ab5279abe377a3b9ae04fe1221f8ec1eb2898
AsyncRAT
7accd5d7eb3bfa32e576554420e4db49b98b1e71523c286c5040fa66998eceb1
AsyncRAT
85ba700122e35a9457bc1d0fa4ae49123c99efe4906e764b26f83e6f15ff3dcf
AsyncRAT
9a8fd2998869405d6dd8a1e48d75c5bd072ab2768f80717b205115ec5303eb71
AsyncRAT
ae82fbab9d30ba8a6f7c542855fdd7f51a7ed3f777fc3fd1c2b1c20f22f776ac
AsyncRAT
d29579a6a0f18f97a81fe6f0e5d3d3c169898563433d79c62fde8059fab8d85b
AsyncRAT
d82786dd43e20aea1972646855e9714d053e86bd41cb5d8767ff038c52cce68f
AsyncRAT
f375501689a6534eb4f7babfddaea594f59c1c457310c4a3346807297a1cf11d
AsyncRAT
+ 1'664 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:asyncrat botnet:default keylogger rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/211014-l1nq5sggbq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
AgentTesla Payload
Async RAT payload
AgentTesla
AsyncRat
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
Malware Config
C2 Extraction:
194.5.97.212:1199
Unpacked files
SH256 hash:
37df1b2837ab4eb0e06200790983dd446daff0d9cb9383f8a60f4bc55d9e9b84
MD5 hash:
f6ef0d8e68371081a16b788d3e0b046b
SHA1 hash:
6e0f74faff173e65d87215cfd1ae73179abd9305
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/c56a3036-b536-4e64-a9dd-bae230d11f96/
Parent samples :
d29579a6a0f18f97a81fe6f0e5d3d3c169898563433d79c62fde8059fab8d85b
9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972
5ac1aaab0a81080aa92df2e4244391805d0eb5134e69e8353fb6eb942eae095e
4d2019d26717d17af772b6deb4063c7a30f6d6a7065bd66e755455e747d3a49a
SH256 hash:
bfa12a2456d40d6c32a1f4e35bd43c81f6f67466234faed8fec19397d0e6d808
MD5 hash:
7a7927bac28be846b2fd2a5d10ba0676
SHA1 hash:
67a7b8616fc8e7aa7bb7a6e2521548e67a7caa2d
Link:
https://www.unpac.me/results/c56a3036-b536-4e64-a9dd-bae230d11f96/
Parent samples :
fb110b1db7c02725d6cb0953cf153a2b5e158d358db136aece90ac06d79cb07d
80dd6d009a2b7ab7aa393d063048320db5ea3920a4fd9cca4a0a76f12183273f
SH256 hash:
dd84706178461d38c2abc828f3c80d083344fd4b139934b1b396412b97f3330b
MD5 hash:
0d6ec47f8ab3b087a9822f04b46d3bfd
SHA1 hash:
5809aabf5f74f87891ea5fe701b0ff6e651bd22e
Link:
https://www.unpac.me/results/c56a3036-b536-4e64-a9dd-bae230d11f96/
SH256 hash:
9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972
MD5 hash:
a7f39a5fb34ce604deeccf9114134280
SHA1 hash:
2f8edacb5d2ec764056e8ebbea1d6dbd8261a100
Link:
https://www.unpac.me/results/c56a3036-b536-4e64-a9dd-bae230d11f96/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9d951b99024a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

Executable exe 9d951b99024a1e1fc4f11508fdbebe9ded208cebbd30affcc6914c315407c972

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/197475/

Comments