MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1a885f37a0884b33ec09369d8c6e2aca8bcf1d8797984c9a388a4f3a3e7d48d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1a885f37a0884b33ec09369d8c6e2aca8bcf1d8797984c9a388a4f3a3e7d48d
SHA3-384 hash: a6b5beb22db09aec140d6016a93a83dd84d0714d837e7e3ce780ff6d2a9e2c880a09d5e3a0f08d750a088e448697ed4f
SHA1 hash: 0c6e8bf888525c2c03be951d25e5a63ecf8e4706
MD5 hash: 1b6fde7f403e4351660485a735e20c54
humanhash: colorado-glucose-kentucky-idaho
File name:New Inquiry.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:882'688 bytes
First seen:2021-06-10 14:26:36 UTC
Last seen:2021-06-10 14:57:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:K3se0nQawaZPtLB/PhhsIQMC4Yb+UA79Ssi3DA7g4lZM4e/ZUdtbkGa:K/0iwPtLB3hhsAorA79SsiUnlNeBUdt
Threatray 65 similar samples on MalwareBazaar
TLSH 6515AFD0514869D6C15B2BF05D36BAB00A2EBEF922308508390737679AB3F5A265FC5F
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
158.69.138.23:7707

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
158.69.138.23:7707 https://threatfox.abuse.ch/ioc/85921/

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
New Inquiry.exe
Verdict:
Malicious activity
Analysis date:
2021-06-10 14:56:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/062030d2-a7b2-48f5-822f-4d2107fa5fb2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/165888/
Detection(s):
SecuriteInfo.com.Trojan.MalPack.ADC.25013.17640.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/800264
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1a885f37a0884b33ec09369d8c6e2aca8bcf1d8797984c9a388a4f3a3e7d48d/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2021-06-10 14:27:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
32
AV detection:
17 of 46 (36.96%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wguil432bcclgpwasnu5rrxcvsulz4oypf4yjsndrcsphi7h2sgq._file
Verdict:
unknown
Similar samples:
0b69258626ece584131b49ae0aa317153d7b4ae602e7f936be7f462905cd9d8a
AsyncRAT
1b514f5e6484c97155dda3e6ee1073f41f19318af2d00d0bec33c6dc7844c3f6
AsyncRAT
3dde92f19924860f0874ee0fe3fab80a1112c20e18d9782528bd7c471f0f2344
AsyncRAT
3f416eb40a2f3043bb0e16cc684a3cecdae3fee9f340e4adf9ddb700e4bf2cfd
AsyncRAT
5b7c7d4bf17521dddc7ee1accfee37d1b50e89f634e7c67439ae92dcef4c32e3
AsyncRAT
7326dddf5871d9ea2a91b0698527b830bb819e899f3eeabf9d46bb4d1c6d0af9
AsyncRAT
7c7f99d2b695777b5809dcee0723304b77a06ea8c72ec8a9e0967e4d8584d585
AsyncRAT
9010e5361743ddacac6baa4a585ed4d9db9ed3ce65401b012d16923afebe414f
AsyncRAT
d236ee873e8191d24434226bc7b80f0542db7ed43323181b5ee8bc3a3de052cc
AsyncRAT
d320373a0b8079d041685c6c814231fd49688f3d740ced28e0b1f59df6600ecc
AsyncRAT
+ 55 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/210610-5qfx3syj26/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
kingmethod.duckdns.org:6606
kingmethod.duckdns.org:7707
kingmethod.duckdns.org:8808
Unpacked files
SH256 hash:
e987e066b6b1ca5c3698a367d405b671a7f33e388289cb6b191faf4796478596
MD5 hash:
8b3814abb5e9cd9fb5da34bc71a4afc2
SHA1 hash:
8005c030dd9d0c1f146d18c4597f0a0f55e16577
Link:
https://www.unpac.me/results/00bf966c-f908-4cd2-b1ef-b2238b64489b/
SH256 hash:
b1a885f37a0884b33ec09369d8c6e2aca8bcf1d8797984c9a388a4f3a3e7d48d
MD5 hash:
1b6fde7f403e4351660485a735e20c54
SHA1 hash:
0c6e8bf888525c2c03be951d25e5a63ecf8e4706
Link:
https://www.unpac.me/results/00bf966c-f908-4cd2-b1ef-b2238b64489b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1a885f37a0884b33ec09369d8c6e2aca8bcf1d8797984c9a388a4f3a3e7d48d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/165888/

Comments