MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b01e228a3a1eadae8c2a23a315ec1b758672d4847ead57402d6d760377104ee0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b01e228a3a1eadae8c2a23a315ec1b758672d4847ead57402d6d760377104ee0
SHA3-384 hash: 44673e502f272e4319bb1acaf2ed44f414893cd739cb129d3ec872fa9a94c068da65c761f34cc76e0c5fd1acd9aff52f
SHA1 hash: ce3eb3443dacba2e474f0e630f624d8f6e8f39f2
MD5 hash: f60b22a73cff36aeebd896f2da95055d
humanhash: carolina-pluto-hydrogen-yankee
File name:download.dat.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:48'640 bytes
First seen:2021-09-20 15:52:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 768:4q+s3pUtDILNCCa+DiptelDSN+iV08Ybyge2zwSq77qgchbWvEgK/JvZVc6KN:4q+AGtQOptKDs4zb1hwSJgKbWnkJvZVS
Threatray 1'348 similar samples on MalwareBazaar
TLSH T177235D4037D88136E2BD47B9ACF3E6458675E2672903CA5D6CC814EA1F13BC59A036FE
Reporter James_inthe_box
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
download.dat.exe
Verdict:
Malicious activity
Analysis date:
2021-09-20 15:57:31 UTC
Tags:
trojan rat asyncrat
Link:
https://app.any.run/tasks/11490fb4-40da-4b0a-96d1-e2ac27de8f19

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189516/
Detection(s):
Win.Malware.Generickdz-9865912-0
Create hunting rule

Win.Malware.Enigmaprotector-9874743-0
Create hunting rule

Win.Malware.Enigmaprotector-9881027-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt to an infection source
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Query of malicious DNS domain
Sending a TCP request to an infection source
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ba0b72a9-2523-4111-b3c6-d327ed62a36d
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/854224
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 486652 Sample: download.dat.exe Startdate: 20/09/2021 Architecture: WINDOWS Score: 96 24 Found malware configuration 2->24 26 Antivirus / Scanner detection for submitted sample 2->26 28 Multi AV Scanner detection for submitted file 2->28 30 5 other signatures 2->30 7 download.dat.exe 2 7 2->7         started        process3 dnsIp4 22 rick63.publicvm.com 194.5.98.135, 49740, 49788, 49789 DANILENKODE Netherlands 7->22 20 C:\Users\user\...\download.dat.exe.log, ASCII 7->20 dropped 32 Detected unpacking (overwrites its own PE header) 7->32 12 cmd.exe 1 7->12         started        14 cmd.exe 7->14         started        file5 signatures6 process7 process8 16 conhost.exe 12->16         started        18 timeout.exe 1 12->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b01e228a3a1eadae8c2a23a315ec1b758672d4847ead57402d6d760377104ee0/
Threat name:
ByteCode-MSIL.Hacktool.CapMouse
Create hunting rule
Status:
Malicious
First seen:
2021-09-18 01:09:00 UTC
AV detection:
33 of 45 (73.33%)
Threat level:
  1/5
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
12f2e964639c39076f29196264c1dcbd3792eaaaa77aca14986a802a122b341b
AsyncRAT
134970a4894d8c7cfd33a8e26f8d4fe1397cd249d0d864f7e50530c051c1cf8d
AsyncRAT
25e21f55b7fbffe0d90e6845044e3e907964a5c278f29fcd1cf0fff9916a2ac3
AsyncRAT
486b4fcc5a6e4f4e949aa11aa3f2e9d8d2075ac8445617af8c41ab214f6dbfa0
AsyncRAT
4f7e6260b30d732b40936166544b75d8ff162f9c75c73d1f7cd37a7e0d3189d0
AsyncRAT
51e4dce11e58aa2be5d3c73056bf45652de5032dcb29636b28f2c1659df135db
AsyncRAT
ca84e70120b5fb479ca54211645ac24d562849107ef0e04df6741c0b88d6d168
AsyncRAT
e94b5bfcea6689274d9bca93a3d77c03ecbf49e2ca1dff4e3fe8baec0f401b3f
AsyncRAT
ecfaef9e7fc7c83be8beedfcbef268c3d5a91a904ed211fa553c9e9b6aaa9c42
AsyncRAT
+ 1'338 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/210920-tbmfsahbhm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Malware Config
C2 Extraction:
rick63.publicvm.com:5900
Unpacked files
SH256 hash:
b01e228a3a1eadae8c2a23a315ec1b758672d4847ead57402d6d760377104ee0
MD5 hash:
f60b22a73cff36aeebd896f2da95055d
SHA1 hash:
ce3eb3443dacba2e474f0e630f624d8f6e8f39f2
Link:
https://www.unpac.me/results/2739f462-33cc-4790-b376-7a50ec7afe8d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b01e228a3a1eadae8c2a23a315ec1b758672d4847ead57402d6d760377104ee0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_B64_Artifacts
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Rule name:INDICATOR_SUSPICIOUS_EXE_DcRatBy
Create hunting rule
Author:ditekSHen
Description:Detects executables containing the string DcRatBy
Rule name:INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
Create hunting rule
Author:ditekSHen
Description:Detects executables attemping to enumerate video devices using WMI
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/189516/

Comments