MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acdef12ec35b82f310c535d3cf08f81d60f1090a25e243772ac5086992104421. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: acdef12ec35b82f310c535d3cf08f81d60f1090a25e243772ac5086992104421
SHA3-384 hash: 8d0ce9b444c9ebb0f1cc30b96148adaa02e3ee1217de5550cb704908a3e1154e354b463660e3ac029c9d2f843515f669
SHA1 hash: 067abf2e195182fd9d69261f0076085712dad208
MD5 hash: 8649b3ac9b90053ac5af0be11e65878b
humanhash: fillet-bakerloo-idaho-jersey
File name:FedExs AWB#5305323204643.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:205'824 bytes
First seen:2020-09-15 13:38:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:1QbYxbEV2AyO4slPqCM4saRROeFDcTZaASvPiyolAmJuLIKXlwXAMKhot8ZCzz:1QbGb6t7QSvKpgnl8o98z
Threatray 338 similar samples on MalwareBazaar
TLSH 9D147CFE2E8D547FCE3A427F106A44C0F93156862685A9CFB0BF93080D15BC76B9179A
Reporter James_inthe_box
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/60578/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a file
Running batch commands
Launching a process
Creating a file in the %AppData% directory
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/466651
Signature
.NET source code contains very large array initializations
Creates an autostart registry key pointing to binary in C:\Windows
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Add file from suspicious location to autostart registry
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected AntiVM_3
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 285734 Sample: FedExs AWB#5305323204643.exe Startdate: 15/09/2020 Architecture: WINDOWS Score: 100 36 Multi AV Scanner detection for submitted file 2->36 38 Yara detected AntiVM_3 2->38 40 Yara detected AsyncRAT 2->40 42 5 other signatures 2->42 7 FedExs AWB#5305323204643.exe 9 2->7         started        10 pcalua.exe 1 2->10         started        12 pcalua.exe 1 1 2->12         started        process3 file4 28 C:\Users\user\...\dfgdjgettyjhmdtetyj.exe, PE32 7->28 dropped 30 dfgdjgettyjhmdtetyj.exe:Zone.Identifier, ASCII 7->30 dropped 32 C:\Users\...\FedExs AWB#5305323204643.exe.log, ASCII 7->32 dropped 34 2 other files (none is malicious) 7->34 dropped 14 cmd.exe 1 7->14         started        16 dfgdjgettyjhmdtetyj.exe 2 7->16         started        18 dfgdjgettyjhmdtetyj.exe 3 10->18         started        process5 signatures6 21 reg.exe 1 1 14->21         started        24 conhost.exe 14->24         started        26 AddInProcess32.exe 16->26         started        44 Multi AV Scanner detection for dropped file 18->44 46 Machine Learning detection for dropped file 18->46 48 Tries to detect virtualization through RDTSC time measurements 18->48 process7 signatures8 50 Creates an autostart registry key pointing to binary in C:\Windows 21->50
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/acdef12ec35b82f310c535d3cf08f81d60f1090a25e243772ac5086992104421/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-09-15 06:54:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vtppclwdlobpgegfgxj46chydvqpccikexreg5zkyuegteqqiqqq._file
Verdict:
suspicious
Similar samples:
0442367788ead3ccf0c9a36805053be48c332ab656f51667f4c08cbbfa3f3ac0
AsyncRAT
2c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
AsyncRAT
3d8ff1b4492a541b44c03733b090c73fd992535d8c4e867abc0e6aeaf5b58b30
AsyncRAT
62afb1cbcacb77aa2ca99cc55c0e3536738415289f53c4a3a57d9b9cc08ee5ab
AsyncRAT
885179565290381c8e8e883f1e4c776507c1ddd3bfa8902f432ea31fbf01c683
AsyncRAT
8de3708192c4e0a075f748391a733950dc3a5f0121a7bfaebc824765847bbd35
AsyncRAT
923909fa41e21d68dbc11443fe31cf99d2792014767e276dd9aa7289a78afa06
AsyncRAT
c2af32087beb20ac52dd19d5cd1f2a389bb58e424790a0c820dd450cf0c48847
AsyncRAT
c639621985cf5e13b426c10f605d28767636aabd6ac4e8d16da8ddc2c2bbc356
AsyncRAT
dba9ab278a6ff48c2119f65e8824b32e1df9d6a9e586828ca3641d34abe3e938
AsyncRAT
+ 328 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
rat persistence family:asyncrat
Link:
https://tria.ge/reports/200915-1naxaazqz2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Executes dropped EXE
Async RAT payload
AsyncRat
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/acdef12ec35b82f310c535d3cf08f81d60f1090a25e243772ac5086992104421

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/60578/

Comments