MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7ee0a83c40c1d71e9730e1cbf6520b023952fb137a32a6449bd0edffcedf3d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7ee0a83c40c1d71e9730e1cbf6520b023952fb137a32a6449bd0edffcedf3d5
SHA3-384 hash: 6052570ed0a77bbee86e3aaa730a60511dbc75af828d0a4a710aab615e369408e39a6e4b0dd4040d4106db814d50b428
SHA1 hash: 242d29871bb91f4d3a48cdde6a46df7f458ae22a
MD5 hash: f20ada3727c5c319d22931d7bc63a007
humanhash: indigo-seven-west-batman
File name:a7ee0a83c40c1d71e9730e1cbf6520b023952fb137a32a6449bd0edffcedf3d5.ps1
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:143'860 bytes
First seen:2024-12-18 07:13:23 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 3072:tDY+KK5sCTIO5MTe4ydXHLM8DIVI96igQycLQxvBzAqx9aKVo6sQ4aR6s:tDY+xiYIO5MTe4ydXHLM8DIVI96igQr4
Threatray 2'047 similar samples on MalwareBazaar
TLSH T195E36C330202FD8F6B7F2F84F5043E951C68247B8B599558FACA0AA925B6520DF39DF4
Magika powershell
Reporter JAMESWT_WT
Tags:92-255-57-155 AsyncRAT booking ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Script.SNH-gen.20150.26332.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67627701653a8698dfda6621
Tags:
virus shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
confuserex fingerprint ipconfig lolbin net obfuscated powershell regsvcs xworm
Link:
https://www.filescan.io/uploads/6762763decf02f600b4b4db0/reports/6b4ee9fc-054f-46c5-b2dc-754cb77219da/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/a7ee0a83c40c1d71e9730e1cbf6520b023952fb137a32a6449bd0edffcedf3d5
Result
Verdict:
MALICIOUS
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1577166
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Uses ipconfig to lookup or modify the Windows network settings
Writes to foreign memory regions
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a7ee0a83c40c1d71e9730e1cbf6520b023952fb137a32a6449bd0edffcedf3d5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7ee0a83c40c1d71e9730e1cbf6520b023952fb137a32a6449bd0edffcedf3d5/
Threat name:
Script-PowerShell.Trojan.XWorm
Create hunting rule
Status:
Malicious
First seen:
2024-12-04 21:38:00 UTC
File Type:
Text
AV detection:
8 of 38 (21.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u7xava6ebqoxd2ltbyol6zjawarzkl5rg6rsuzcjxuhn77hn6pkq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
3a5134cc11c7c47b7268e7bf6bf1556c5ff5044af54b7931cae652bfd8d83717
AsyncRAT
3d6e7e00580e1b17849dcd6c80cbe10b09b2e677deda5016c3baba36517dd462
AsyncRAT
b24e8948d314d492f4e1ae9fd78e8fcb41ee5c9adfd6e9ab7927fca7c333003c
AsyncRAT
c3bbb675ebfb5dc5d747551529c7feea42f8eeef6675d76f37afa87bcbf02ab3
AsyncRAT
error
AsyncRAT
f3831d6ca373f539fec77e975ae4fc26451bfb3113513813819ea1111f31a81a
AsyncRAT
+ 2'037 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution rat trojan
Link:
https://tria.ge/reports/241218-h2mzfsynbt/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
92.255.57.155:4411
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments