MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f
SHA3-384 hash: 307ce87c349c3ee81f18a143d9ffe48ad99b3a29bfb2d9df05053b87828c5c484b22e94ef02921260e250dd5d6f041b2
SHA1 hash: 1075dd593ca755bc91c95724d11e3f4b6ff0d6f2
MD5 hash: 452de3e5bb28ef5ab02e7621d0067cdc
humanhash: leopard-florida-beer-juliet
File name:Chris Mike Resume.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'001'472 bytes
First seen:2021-07-05 22:09:45 UTC
Last seen:2021-07-05 22:50:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 24576:TBI33qfeNBp1C9VyWOFk7Ke+3xyimNFv8u7XS:TBI3afeNBp1kOF3eIyhoU
Threatray 1'529 similar samples on MalwareBazaar
TLSH 73254A32A2FE5A61CDEBC6F58F7052BC4F257E61FB1AE23E048575090DB0BA50E15623
Reporter James_inthe_box
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Chris Mike Resume.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-05 22:12:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6805f0ff-e8c8-470b-8722-efbadc1383f6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/169800/
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.908.21869.27282.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/40eab30b-be77-4a43-8098-040142ddf822
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/811978
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 444390 Sample: Chris Mike Resume.exe Startdate: 06/07/2021 Architecture: WINDOWS Score: 100 43 adikremix.ydns.eu 2->43 47 Found malware configuration 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 Yara detected AsyncRAT 2->51 53 4 other signatures 2->53 10 Chris Mike Resume.exe 3 2->10         started        13 configure.exe 2 2->13         started        signatures3 process4 file5 41 C:\Users\user\...\Chris Mike Resume.exe.log, ASCII 10->41 dropped 16 Chris Mike Resume.exe 6 10->16         started        57 Multi AV Scanner detection for dropped file 13->57 59 Machine Learning detection for dropped file 13->59 61 Injects a PE file into a foreign processes 13->61 19 configure.exe 2 13->19         started        signatures6 process7 file8 39 C:\Users\user\AppData\Roaming\configure.exe, PE32 16->39 dropped 21 cmd.exe 1 16->21         started        24 cmd.exe 1 16->24         started        process9 signatures10 55 Uses schtasks.exe or at.exe to add and modify task schedules 21->55 26 conhost.exe 21->26         started        28 schtasks.exe 1 21->28         started        30 configure.exe 3 24->30         started        32 conhost.exe 24->32         started        34 timeout.exe 1 24->34         started        process11 process12 36 configure.exe 2 30->36         started        dnsIp13 45 adikremix.ydns.eu 194.5.98.8, 3030, 49759, 49760 DANILENKODE Netherlands 36->45
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-05 07:13:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
35
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6jqwpsi56uu6pntbbhd6wkbuwpp6wyow75ssqs6j5fdtobc7nxq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
23ae26a2920f4b2fefdc074fa7f052da44992bd4ad639711eb38f8e11241a2b5
AsyncRAT
47fba2ac8b8734d57e0f0d34d573a5c0c567d22683bc128caa58946cca51565e
AsyncRAT
5402e9250c7e91ea7e8c7261e2b3b566706bc7ebf8deaf926c88fd99613fb6b2
AsyncRAT
6dda8584a5682afdc017e2e421619b02fc9f57a67de615332797b3e96981864d
AsyncRAT
a494c1e303160d0fb163cdd38cd218288239e93376b7e5e9ee85274430f6f1fb
AsyncRAT
b019e8d729a835b9834889650eb87183538da0a1ff600e138db6065efea24a57
AsyncRAT
b603fd540d4a4e79052ee4b93a3b4155eb2bacc3fd15ef9e4a9e9d94060c522a
AsyncRAT
bbedd4315710a57d6ca9b6fe2bd31516ce0f3513d26cb95de48734879138a666
AsyncRAT
d5cbdab4cccf60d538b29be7dc3974f279cdf7c50689736120649820ea9f7d32
AsyncRAT
f1fcab9f0f290bf647d1b302ca4c3f41f031db0d558ae1bc95532bc086d5d8b7
AsyncRAT
+ 1'519 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/210705-eel8hlp48e/
Behaviour
Creates scheduled task(s)
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
adikremix.ydns.eu:3030
Unpacked files
SH256 hash:
09451b861f489e3ded56fae6a213d3e5b095e3c4a43ded2759c378aa0b75412c
MD5 hash:
d6ca9181ecfa3cefc4951fb727c86e2b
SHA1 hash:
a172030612eb81ad1dbf1aad4d1cdc45b37c56e1
Link:
https://www.unpac.me/results/95c37a3f-fe7b-46ae-94aa-5290510575a4/
SH256 hash:
5209992fd1f96cd1959efb5e1afa71f5c9ae2ab4430e258fe9d0ec915098d110
MD5 hash:
257ca10e5cbb2f8bdf0ae6f3e900e11e
SHA1 hash:
9d25ee80dbe3bbce5ab4479912c5e21b19b6aeec
Link:
https://www.unpac.me/results/95c37a3f-fe7b-46ae-94aa-5290510575a4/
SH256 hash:
0dd721fb633fb04a37430c0334da5b1b2fdfcea28461b243d9fa40347b81735e
MD5 hash:
9ae15308490d1a233629bb6e214bc602
SHA1 hash:
4d8e041f9fbaa55ab95cef4c0b15d70feef24d40
Detections:
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/95c37a3f-fe7b-46ae-94aa-5290510575a4/
Parent samples :
ef73a5f8ceb7220d18ea3d2b22fbf948e7bc290f25c79bb68f29e2be30bd3068
d8d7a96e0ae07884d4626039926ca38fc5889419e480ce856635e7270e273deb
44342d82310b3113282ae36a8b89eef47feb4cefb5131b95164df4e18ee9ebc3
9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f
c32016214bcd487bfd5b76a6d3551ef39f766bbfff4daab52169165e2c411cfe
a5a2e98216864938c20330ca7f58165283ec3c6944117851c63a6cfe90265786
33fab01e9baaafc2a5534494c5b1ffa900d414694b5c499c9a4180959268a602
87b7b68ed10c1e85866fc17772627f0577d6f6e578ee8a36a0fb598e46c78cd0
a0a19b1ede3ac435ca89d2867030b210f8e83d7dcd26a2914dbc83d54df657c9
e7a044eb8b3033ba86c6635616654248143d9987124af92be95a18c08e40c836
SH256 hash:
9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f
MD5 hash:
452de3e5bb28ef5ab02e7621d0067cdc
SHA1 hash:
1075dd593ca755bc91c95724d11e3f4b6ff0d6f2
Link:
https://www.unpac.me/results/95c37a3f-fe7b-46ae-94aa-5290510575a4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/9f930b3e48efa94f3db3084e3f5941a59eff5b0eb7fb29425e4f4a39b822fb6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/169800/

Comments