MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 accc1335de419c84a5c045da87bb17f741aa1df71ee62c2ea1b8d010e32df890. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: accc1335de419c84a5c045da87bb17f741aa1df71ee62c2ea1b8d010e32df890
SHA3-384 hash: 7e46e51ec89ec4f1361eb85a95818e7537acffba48845f6bbe98df14d36638d4ad104ade501f6da61ac9de82a5ca47d7
SHA1 hash: 1321ee99fa8b68244a5a9776a4cdc30467ee470c
MD5 hash: 2a949ab21ee139487af2e86509b59eb9
humanhash: september-chicken-xray-magazine
File name:2a949ab21ee139487af2e86509b59eb9
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:335'360 bytes
First seen:2021-07-06 07:25:09 UTC
Last seen:2021-07-06 07:50:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:zYrX+K/LK+3xoeXQutwX6iEbZXPn3C9fd4Bs5iiDHUUD9R/:z6bmeSxEbcF4BsRHUUx
Threatray 645 similar samples on MalwareBazaar
TLSH F164D02A77919B52D45845B5C1E7553407F3AAC363B3E2877F8802DA0E127F88D8ABCD
Reporter zbetcheckin
Tags:32 AsyncRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2a949ab21ee139487af2e86509b59eb9
Verdict:
Malicious activity
Analysis date:
2021-07-06 07:30:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7699c050-0e80-4ec0-974a-6fd4e95b6b8f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/169901/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37185241.20437.18224.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4076a4d0-9029-426a-bf54-7809614e71a7
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/812124
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/accc1335de419c84a5c045da87bb17f741aa1df71ee62c2ea1b8d010e32df890/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-04 10:11:22 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
0aebdeb98f747dd7c32f0a3644e392fc859be7728d125510ee59ce790d4e93e6
AsyncRAT
473b56394b74234a01d3d49d249efb5da557cf356fffc1dc3cac654303964ea9
AsyncRAT
500db2ef97a164d00676ba3cff04cf5a34962220a2577ee9833333ebc685c807
AsyncRAT
956bd054893f8940d72ec94175b2f063ac759a1f9cee3a0cad7eb3b7871bae2f
AsyncRAT
a738901fe0f246517e9d1b60c7df29cc9ff4db2ff588e5e28f9bf7e6ff3267a0
AsyncRAT
b17bfed7ccb65140f22de398cfcb56faa877dd36410bac51453f8ad9f1537bda
AsyncRAT
b811328fd6ddf4562a9f6066fd93193e3a344fc482dd9303c131d81888017b9a
AsyncRAT
c5e533f597712d3ea77932fdd8f3e5075d947598865ef2123cc65d310720d9a9
AsyncRAT
f2ed40ab9c2eb52484d79b485a78e2779dd300b7513eac17ec4e39fd4a9614a8
AsyncRAT
f6c873080547760ab6e3e7d4b59c74cbfb9151275e7aa6f888d251f4549c7e69
AsyncRAT
+ 635 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/210706-b2b17yjcn6/
Behaviour
Async RAT payload
AsyncRat
Unpacked files
SH256 hash:
14511c2a493809150748ae518a716941374c6f30101f264cfc3423fbb5d224c9
MD5 hash:
79afc531ab484c0d85d1f5e4cdf3ce40
SHA1 hash:
97a357854c8452e8f18dcbb9eeab4a7f0e50a6b0
Link:
https://www.unpac.me/results/089e6a17-7d71-4843-a8d0-635139f430ee/
SH256 hash:
accc1335de419c84a5c045da87bb17f741aa1df71ee62c2ea1b8d010e32df890
MD5 hash:
2a949ab21ee139487af2e86509b59eb9
SHA1 hash:
1321ee99fa8b68244a5a9776a4cdc30467ee470c
Link:
https://www.unpac.me/results/089e6a17-7d71-4843-a8d0-635139f430ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.98
Link:
https://yomi.yoroi.company/submissions/accc1335de419c84a5c045da87bb17f741aa1df71ee62c2ea1b8d010e32df890

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe accc1335de419c84a5c045da87bb17f741aa1df71ee62c2ea1b8d010e32df890

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1430322/
Cape
Cape
https://www.capesandbox.com/analysis/169901/

Comments


Avatar
zbet commented on 2021-07-06 07:25:10 UTC

url : hxxp://metalshoopp.000webhostapp.com/reegasm.exe