MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abeff15c4406f81d4332fa38897f618ea4c661335e6890b764b73408cfe4f48a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abeff15c4406f81d4332fa38897f618ea4c661335e6890b764b73408cfe4f48a
SHA3-384 hash: 2ba95124d8aff514c10abd98cb1eb410ab31cac9097cad6de4ff9e75be2442685112099b5edf92014fa62a1469f0ea18
SHA1 hash: 6b12fd3134b80a71401ae194b1643a6f49742cfa
MD5 hash: 80dcdae93f0b24e4e32be1eb9b505d43
humanhash: foxtrot-oxygen-carolina-robert
File name:04026caca92e9c7365fb324caf88753a
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:10'484'834 bytes
First seen:2020-11-17 12:38:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'476 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 196608:0yI+5ARPbdhFIeJzqcFFaUFMxOr0dDpToAN5NNop5dyh:bN5AR5/VLFpMr9BN5NWfdS
Threatray 181 similar samples on MalwareBazaar
TLSH 78B622B851DE2063F1AF4638B5AD7D9402B2B197DFCBAE48137CE1710AAE7523B0560D
Reporter seifreed
Tags:AsyncRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abeff15c4406f81d4332fa38897f618ea4c661335e6890b764b73408cfe4f48a/
Threat name:
ByteCode-MSIL.Infostealer.Maslog
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:44:19 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vpx7cxcea34b2qzs7i4is73br2smmyjtlzujbn3ew42art7e6sfa._file
Verdict:
unknown
Similar samples:
00e08a19f48abe62f711ef9738a94ef764314b98a430765127f1a90a1329e40c
AsyncRAT
0137042c076d728f11067b31394854e43724b1b588a65d0718d696ac2efd7f3f
AsyncRAT
1796a7c25fa960607a5711f5c36d0c8494bf8473132e18773103fbe2e56e85f1
AsyncRAT
3ee82cb6b92599b06273f1a48091fdbab0ca285fb8147501a0392b8a2eba583c
AsyncRAT
4eb8a84959817bb937cdd20b76b47ad561cf826e5bbcfe52a56d4ea0628e1df3
AsyncRAT
502c86ed05c4bf9f40b9b680cb238e42c6e3f678e9e2df84f1013c40be039e63
AsyncRAT
674cac26b5ee006a476669c6857e24a8187ef94945d521c8bbe9069ec74494ba
AsyncRAT
6c7219ce0b85bcda4ea4fed96e66f08e2621463ac3bc1da55a108af0b35758c0
AsyncRAT
ce6ce197dd82619b4c706f4882027c4c84b977be516919c978fc571e367fed92
AsyncRAT
ff734df4d09afad52e931fce898a5497b78081fbca44f091e55a3da4b47c1350
AsyncRAT
+ 171 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/201117-g1vlf97k16/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
AsyncRat
Malware Config
C2 Extraction:
:
Unpacked files
SH256 hash:
abeff15c4406f81d4332fa38897f618ea4c661335e6890b764b73408cfe4f48a
MD5 hash:
80dcdae93f0b24e4e32be1eb9b505d43
SHA1 hash:
6b12fd3134b80a71401ae194b1643a6f49742cfa
Link:
https://www.unpac.me/results/12dd778c-7dc6-4158-97ae-aa001dcd7362/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments