MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 30 File information Comments

SHA256 hash:	aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1
SHA3-384 hash:	4312028a385bae869dd400e2600d08fbfd3782da08c63316142d975475e75d992180edfaee8ad821f5b47b5dfa962c54
SHA1 hash:	b6dfd1478a58caca13ed041995840ea0250cff3e
MD5 hash:	4fc60bc5d5efe63f44146bf1f1bece0d
humanhash:	mississippi-indigo-hydrogen-minnesota
File name:	30% Order payment-BLQuote_'PO#385995790.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	1'024'512 bytes
First seen:	2025-01-09 18:14:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	948cc502fe9226992dce9417f952fce3 (1'182 x CredentialFlusher, 446 x Formbook, 231 x AgentTesla)
ssdeep	24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8a8hXks:6TvC/MTQYxsWR7a8
Threatray	5'608 similar samples on MalwareBazaar
TLSH	T18B25AE027391C062FF9B92334B5AF6115BBC69260123E61F13A81D7ABE701B1563E7A3
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10522/11/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
File icon (PE):
dhash icon	aae2f3e38383b629 (2'034 x Formbook, 1'183 x CredentialFlusher, 666 x AgentTesla)
Reporter	lowmal3
Tags:	AsyncRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

565

Origin country :

Vendor Threat Intelligence

Malware family:

asyncrat

ID:

File name:

30Orderpayment-BLQuote_PO385995790.exe

Verdict:

Malicious activity

Analysis date:

2025-01-09 18:21:29 UTC

Tags:

asyncrat

Link:

https://app.any.run/tasks/faff4c61-8848-4ebf-902d-8d5f3a027b54

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Generic.33203615.28472.17882.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678013a8ffdcee13ec88fb1b

Tags:

autorun autoit emotet

Result

Verdict:

Clean

Maliciousness:

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context autoit compiled-script evasive extrac32 fingerprint keylogger lolbin masquerade microsoft_visual_cc msiexec nanocore packed packed packer_detected

Link:

https://www.filescan.io/uploads/6780122e2fc75eab0260b9c4/reports/97130aaf-dd84-45d4-9847-5bdbe76a8f48/overview

Verdict:

Malicious

Labled as:

Trojan.PasswordStealer.Generic

Link:

https://www.hybrid-analysis.com/sample/aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce0e7b06-a4fc-42f6-a45c-c72086b2fa01

Result

Threat name:

AsyncRAT

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1586938

Signature

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Found API chain indicative of sandbox detection

Found malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-12-19 01:10:20 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vk3d24zjgasofqjv4emss4bod7k4esl7lcc7e3s2nxdomqe4shiq._file

Verdict:

malicious

Label(s):

unknown_loader_036

asyncrat

Result

Malware family:

asyncrat

Score:

10/10

Tags:

family:asyncrat botnet:default discovery rat

Link:

https://tria.ge/reports/250109-wvwvnswrdw/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

AutoIT Executable

Suspicious use of SetThreadContext

Drops startup file

Executes dropped EXE

Loads dropped DLL

AsyncRat

Asyncrat family

Malware Config

C2 Extraction:

69.174.100.131:6606

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7ee691d5-e401-4307-a4a1-6e4cd5b1b508

Unpacked files

SH256 hash:

d873934ae172735ee6ac1fc6f43bcf254ed69244e497348b51bd5e5905de27b3

MD5 hash:

02190864ed79417b4f8a73a52480ac63

SHA1 hash:

555ec16a9c1409aa77240f8b3505f56a8366ca0f

Detections:

AsyncRAT

win_asyncrat_w0

asyncrat

win_asyncrat_bytecodes

win_asyncrat_unobfuscated

INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Link:

https://www.unpac.me/results/117ed3ce-c4ca-4ef2-b978-e911cb1daf19/

Parent samples :

4b5cc1e99d28651fbb693422c5d392c5d47dfa61c8ec4995197706de5cb3442a
18725cce353d29c5fb73d6b93b17e0ddef59e53bc19c637cc15a96b921fcc173
aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1
8f42d1e07595808544eed18a45e8d7220dff40597d4d53d0f63fab47554afbdf

SH256 hash:

aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1

MD5 hash:

4fc60bc5d5efe63f44146bf1f1bece0d

SHA1 hash:

b6dfd1478a58caca13ed041995840ea0250cff3e

Link:

https://www.unpac.me/results/117ed3ce-c4ca-4ef2-b978-e911cb1daf19/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	asyncrat Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect AsyncRat in memory
Reference:	internal research

Rule name:	asyncrat_kingrat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	golang_david_CSC846 Create hunting rule
Author:	David
Description:	CSC-846 Golang

Rule name:	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse Create hunting rule
Author:	ditekSHen
Description:	Detects file containing reversed ASEP Autorun registry keys

Rule name:	malware_asyncrat Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect AsyncRat in memory
Reference:	internal research

Rule name:	MAL_AsnycRAT Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects AsnycRAT based on it's config decryption routine

Rule name:	MAL_AsyncRAT_Config_Decryption Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects AsnycRAT based on it's config decryption routine

Rule name:	msil_suspicious_use_of_strreverse Create hunting rule
Author:	dr4k0nia
Description:	Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Njrat Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_DOTNET_PE_List_AV Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detecs .NET Binary that lists installed AVs

Rule name:	SUSP_Reverse_Run_Key Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a Reversed Run Key

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	Windows_Generic_Threat_ce98c4bc Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Asyncrat_11a11ba1 Create hunting rule
Author:	Elastic Security

Rule name:	win_asyncrat_bytecodes Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects bytecodes present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)

Rule name:	win_asyncrat_j1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects AsyncRAT

Rule name:	win_asyncrat_w0 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect AsyncRat in memory
Reference:	internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

exe aab63d73293024e2c135e11929702e1fd5c2497f5885f26e5a6dc6e6409c91d1

(this sample)

Delivery method

Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::CopySid ADVAPI32.dll::FreeSid ADVAPI32.dll::GetLengthSid ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::GetAce
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoCreateInstanceEx ole32.dll::CoInitializeSecurity ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::mciSendStringW WINMM.dll::timeGetTime WINMM.dll::waveOutSetVolume
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AddAce ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::CheckTokenMembership ADVAPI32.dll::DuplicateTokenEx ADVAPI32.dll::GetAclInformation ADVAPI32.dll::GetSecurityDescriptorDacl
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::ShellExecuteW SHELL32.dll::SHFileOperationW
WIN32_PROCESS_API	Can Create Process and Threads	ADVAPI32.dll::CreateProcessAsUserW KERNEL32.dll::CreateProcessW ADVAPI32.dll::CreateProcessWithLogonW KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenProcessToken ADVAPI32.dll::OpenThreadToken
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::SetSystemPowerState KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileExW KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::CreateFileW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW ADVAPI32.dll::GetUserNameW ADVAPI32.dll::LogonUserW ADVAPI32.dll::LookupPrivilegeValueW
WIN_NETWORK_API	Supports Windows Networking	MPR.dll::WNetAddConnection2W MPR.dll::WNetUseConnectionW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegConnectRegistryW ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::BlockInput USER32.dll::CloseDesktop USER32.dll::CreateMenu USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::FindWindowW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample