MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8
SHA3-384 hash: a0b95026ee012b085a93812c7eec79ea1f8204839701fb7e5caa84f5ccd395eddf3afa20112c5b74d7a03c5a4528b162
SHA1 hash: a786dcb3bffe527a6954d3c242138d34707e21d3
MD5 hash: cc1b6971441d2ec84c14247d4f014912
humanhash: sixteen-artist-fourteen-golf
File name:cc1b6971441d2ec84c14247d4f014912
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:33'280 bytes
First seen:2022-02-18 11:47:46 UTC
Last seen:2022-02-18 13:51:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'753 x AgentTesla, 19'659 x Formbook, 12'249 x SnakeKeylogger)
ssdeep 384:vkj1IKifPKGg8xhtYMCbF2deA5yFIe69UBZNNWKnCIpS3hb8auKz2J3:vqGKiexxb8/kLYqKe86J
Threatray 2'498 similar samples on MalwareBazaar
TLSH T17EE22925765C8E68CB28877AE8D3D5F803E0FE8148A0C43E64E0374B39BF759DA36641
File icon (PE):PE icon
dhash icon 0f0e696d33134555 (7 x BitRAT, 1 x AsyncRAT)
Reporter zbetcheckin
Tags:32 AsyncRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
241
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/242528/
Detection(s):
SecuriteInfo.com.Win32.DropperX-genDrp.25729.31557.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/620f877ba2660f3bb9faf0fa/reports/ce5792e2-b6cd-4af0-9afd-72ea08094663/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/98a59941-ca80-4ee4-9e2b-54f10b8833c0
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/942184
Signature
.NET source code contains potential unpacker
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Yara detected AsyncRAT
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 574659 Sample: ibR6ZYu3xp Startdate: 18/02/2022 Architecture: WINDOWS Score: 100 60 yahoo.com 2->60 76 Found malware configuration 2->76 78 Malicious sample detected (through community Yara rule) 2->78 80 Multi AV Scanner detection for submitted file 2->80 82 5 other signatures 2->82 8 ibR6ZYu3xp.exe 16 7 2->8         started        12 Zdrqamx.exe 1 2->12         started        15 Zdrqamx.exe 2->15         started        signatures3 process4 dnsIp5 72 esalog-bg.com 193.107.36.199, 49779, 80 SUPERHOSTING_ASBG Bulgaria 8->72 54 C:\Users\user\AppData\Roaming\...\Zdrqamx.exe, PE32 8->54 dropped 56 C:\Users\user\...\Zdrqamx.exe:Zone.Identifier, ASCII 8->56 dropped 58 C:\Users\user\AppData\...\ibR6ZYu3xp.exe.log, ASCII 8->58 dropped 17 cmd.exe 1 8->17         started        20 MSBuild.exe 2 8->20         started        23 cmd.exe 1 8->23         started        33 10 other processes 8->33 84 Multi AV Scanner detection for dropped file 12->84 86 Machine Learning detection for dropped file 12->86 25 cmd.exe 12->25         started        27 cmd.exe 12->27         started        29 cmd.exe 12->29         started        31 cmd.exe 15->31         started        file6 signatures7 process8 dnsIp9 74 Uses ping.exe to check the status of other devices and networks 17->74 35 PING.EXE 1 17->35         started        38 conhost.exe 17->38         started        70 212.193.30.54, 49821, 8755 SPD-NETTR Russian Federation 20->70 42 2 other processes 23->42 44 2 other processes 25->44 46 2 other processes 27->46 48 2 other processes 29->48 50 2 other processes 31->50 40 PING.EXE 1 33->40         started        52 15 other processes 33->52 signatures10 process11 dnsIp12 62 yahoo.com 98.137.11.163 YAHOO-GQ1US United States 35->62 64 74.6.231.20 YAHOO-NE1US United States 52->64 66 98.137.11.164 YAHOO-GQ1US United States 52->66 68 2 other IPs or domains 52->68
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8/
Threat name:
ByteCode-MSIL.Downloader.Seraph
Create hunting rule
Status:
Malicious
First seen:
2022-02-18 11:48:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 28 (57.14%)
Threat level:
  3/5
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0b8a5cbe236a7057a2904f18480b85ce9b59b891c0a1a041516248d35760744d
AsyncRAT
1299373ec40fc1f3f16957338574a9ad51a94e62220cc8c08f1ad81dee443544
AsyncRAT
16fc0cec13d88da3d0a36e4c42e733db8f1e21cafc18fd813a25cd0bc835f35a
AsyncRAT
213528a5164fcb5253010129aac3855b4b905c9c5a9514a2a2b9db7e2b592a73
AsyncRAT
2799478f81991ca4ba86ccf7a234f95199cf3743f6a1112f20666b6ce104e557
AsyncRAT
438e8f8d626ca18bb5fbd3499cad058033b199c865badba6415e362d5b8dcd49
AsyncRAT
a4df5e9015f70b47dc4f2e6bae0fbeb9d108979e0cda7ef54aa123a0d33bdf8b
AsyncRAT
bcf7571a4d9b25fabdc2d6120b1b2d7bd8446ea2bc3a5da1d4127954920067de
AsyncRAT
ceddcfa72226e91f7435facafe6631d1385ca4d246d242d5136ac4e9462b8611
AsyncRAT
ecb8839117d73d33390c84f7f6e02f4970156ccb2da7b48083922f60625fa8be
AsyncRAT
+ 2'488 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:1 persistence rat
Link:
https://tria.ge/reports/220218-nyfzmadchn/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
212.193.30.54:8755
Unpacked files
SH256 hash:
af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8
MD5 hash:
cc1b6971441d2ec84c14247d4f014912
SHA1 hash:
a786dcb3bffe527a6954d3c242138d34707e21d3
Link:
https://www.unpac.me/results/98c1327b-0cea-4258-8bb9-24c591d6533e/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/af1c3dd3dc0c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2047522/
Cape
Cape
https://www.capesandbox.com/analysis/242528/

Comments


Avatar
zbet commented on 2022-02-18 11:47:47 UTC

url : hxxp://esalog-bg.com/images1/book/gig/a/Criyop.exe