MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a341b8f10a51457c11292173cfa48fe49256c9ccef8ec045753b49b2bfa935d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a341b8f10a51457c11292173cfa48fe49256c9ccef8ec045753b49b2bfa935d6
SHA3-384 hash: d8216b78be7b7dcb0147224c9ecc8b40c6081e49e92db40a07c4e71ca46c4158ec33b9a33ec3d798fc5b7ffda417f1cc
SHA1 hash: 82f1e8e87c9b0f81a73b8af0369d09c8f8eb5ac9
MD5 hash: 5995285834997162a85fa2fa235faebf
humanhash: sixteen-jig-charlie-equal
File name:Server1.ps1
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:986'374 bytes
First seen:2021-10-19 09:44:48 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 1536:OrcBcCsaNr+Xexv2+woFMaQYIf7LFTe+XUWh5D+VXEXtXX8XZXnRcZtDRhj7aqDp:OIBcCsaNiX6v2+woLOFTr9r8ZkX
Threatray 151 similar samples on MalwareBazaar
TLSH T1E9254271B7BE55006C2520BEFAB61DB71C91A19CE58FEFAA012C1A7CA4C7C572E48CD4
Reporter pr0xylife
Tags:AsyncRAT ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
336
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
50%
Link:
https://www.filescan.io/uploads/616e93a4db358dd15ec3a391/reports/4eb9fa01-f830-49c0-81c8-2d0fd0775dd8/overview
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a341b8f10a51457c11292173cfa48fe49256c9ccef8ec045753b49b2bfa935d6/
Threat name:
Script-PowerShell.Trojan.AsyncRAT
Create hunting rule
Status:
Suspicious
First seen:
2021-10-19 09:45:10 UTC
AV detection:
7 of 28 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=una3r4ikkfcxyejjefz47jep4sjfnsom56hmarlvhne3fp5jgxla._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
043624c213f4575f22c66f72f20dd68a1126363beefd8d1c7c5c0d82a5a556ce
AsyncRAT
3959233284f7f4a7bec2a314820e3b8e073591a31dfe8c43a03f7a24833b7fd3
AsyncRAT
3fc706ce01f2ff41e02943699351d1ad3c32160cbd0be0b8bb85f9472303d4c2
AsyncRAT
414a79e6c87489cb73e9176e867d554788a28ba86cb4e00f3f8fed15400999bd
AsyncRAT
6d392e6956913772c10d49c5a64933b5bbc17d66a8ce02e5ed6716141af438ed
AsyncRAT
766d8e9d2d0de0a0ba2440a847e7eb7da3e69d51331e15a61ec1d25d3d92fc3e
AsyncRAT
79dbd50c88d7cb8460d8174c4ebca918f8b6f7b5cdde217cb653e649fe042e04
AsyncRAT
b24993e503f1ba6774ff88faebc3487bfece018b3baac4b0ada076d7f86ef26d
AsyncRAT
c3f8019ba1f837f109cf75b3aeb84e79900030e8f098302490dd7bca4d2345b0
AsyncRAT
eb30ab0173d9def4895227fbc1f82c21bbd7af6209d268a483c57e5ee04926b3
AsyncRAT
+ 141 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/211019-lq4plsgdfj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
139.28.37.182:5200
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a341b8f10a51/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a341b8f10a51457c11292173cfa48fe49256c9ccef8ec045753b49b2bfa935d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments