MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b263c9c28e7e6626411ac0069bb773850f4f7b98490fe4672db09a5acac43884. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b263c9c28e7e6626411ac0069bb773850f4f7b98490fe4672db09a5acac43884
SHA3-384 hash: a7f3d1e422ca3a9df8e4a3f15528a0634a2c1b35d30b0b584fbf4631aed4b3998e962da1708bc15b8fe7fda240fd260f
SHA1 hash: a677f4a82d8d8a67ea780340b06d952686ac16d0
MD5 hash: 2d06ddab268977e89a69aaba1968f954
humanhash: jig-five-iowa-violet
File name:PONO.ENQUIRY-210604.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:745'472 bytes
First seen:2021-04-06 14:40:10 UTC
Last seen:2021-04-06 20:32:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:kSZh0GKDlDTPaCJS6HwvJBZWpLG6YePU9vTgMjvLe:hZaLhPaybQxBZTec97vLe
Threatray 653 similar samples on MalwareBazaar
TLSH D4F4CF3027A8D9D2D37E57B40862C12403F8BD16DB72E70E6E9430ED2E76792D93B642
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
68.183.193.20:7707

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
68.183.193.20:7707 https://threatfox.abuse.ch/ioc/7002/

Intelligence

File Origin
# of uploads :
3
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PONO.ENQUIRY-210604.exe
Verdict:
Malicious activity
Analysis date:
2021-04-06 14:51:13 UTC
Tags:
trojan rat asyncrat
Link:
https://app.any.run/tasks/437955ae-64d3-4395-b52d-e486b2d45d03

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/132675/
Detection(s):
SecuriteInfo.com.Scr.Malcodegdn30.5261.18370.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/667684
Signature
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 382773 Sample: PONO.ENQUIRY-210604.exe Startdate: 06/04/2021 Architecture: WINDOWS Score: 100 34 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->34 36 Found malware configuration 2->36 38 Sigma detected: Scheduled temp file as task from temp location 2->38 40 6 other signatures 2->40 7 PONO.ENQUIRY-210604.exe 7 2->7         started        process3 file4 28 C:\Users\user\AppData\Roaming\dnpsFUGDU.exe, PE32 7->28 dropped 30 C:\Users\user\AppData\Local\...\tmpBA52.tmp, XML 7->30 dropped 42 Uses schtasks.exe or at.exe to add and modify task schedules 7->42 44 Adds a directory exclusion to Windows Defender 7->44 46 Injects a PE file into a foreign processes 7->46 11 PONO.ENQUIRY-210604.exe 7->11         started        14 powershell.exe 24 7->14         started        16 powershell.exe 24 7->16         started        18 2 other processes 7->18 signatures5 process6 dnsIp7 32 walter12ryan.duckdns.org 68.183.193.20, 49708, 6606 DIGITALOCEAN-ASNUS United States 11->32 20 conhost.exe 14->20         started        22 conhost.exe 16->22         started        24 conhost.exe 18->24         started        26 conhost.exe 18->26         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b263c9c28e7e6626411ac0069bb773850f4f7b98490fe4672db09a5acac43884/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 14:41:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjr4tquopztcmqi2yadjxn3tquhu664yjeh6izznwcnfvswehcca._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
2c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
AsyncRAT
580b46d3c66531c7398e60857e6d5177d500d75cc802ded85965e0c2a09e255c
AsyncRAT
6a552b03353efc74c7871b59d8844ee8990a224de336ca893e1b74d10cd4b16b
AsyncRAT
73ffaa868244eb4bcee7027ce57d30e604dda4dcda00fcfcbfb43103909ea52b
AsyncRAT
7fa47492c2377042d9b56f5d81c5e342aced8f51ca4237c9cd228d9b13b3bca5
AsyncRAT
867eb496d9f6122024560c00e0a2fde238fed90558dd0b4b838047c8eed8196c
AsyncRAT
86b22d8497ac1df55b76bddca6c021ec4b9995b00caea5effeeffe4e9f592e44
AsyncRAT
8dd3b9fb0158903433d23f879d07820b8110a4b6417f3deda72342c2f698384e
AsyncRAT
b5c98bb2d9391ffb93eea1ff796c1c924493c8e58160278c4ffe7ed3ba234ed2
AsyncRAT
bcfcc5a278671fbe1b5f5f27c6d61921add83e57a0c61f80a165455b3fe0875a
AsyncRAT
+ 643 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/210406-p8qjyzgz5s/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
walter12ryan.duckdns.org:6606
walter12ryan.duckdns.org:7707
walter12ryan.duckdns.org:8808
Unpacked files
SH256 hash:
6590b9ec4fa84e44c372fda26f47d6d58859d74869621c6bdd4086e6ae411379
MD5 hash:
95dfa1a9015a17a1d49b4faa3f3d999d
SHA1 hash:
427b72727b28436554d0443d797f19b2ea37cc16
Link:
https://www.unpac.me/results/195263d5-e86c-47c7-a56e-e7b7f6bcafc3/
SH256 hash:
b263c9c28e7e6626411ac0069bb773850f4f7b98490fe4672db09a5acac43884
MD5 hash:
2d06ddab268977e89a69aaba1968f954
SHA1 hash:
a677f4a82d8d8a67ea780340b06d952686ac16d0
Link:
https://www.unpac.me/results/195263d5-e86c-47c7-a56e-e7b7f6bcafc3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b263c9c28e7e6626411ac0069bb773850f4f7b98490fe4672db09a5acac43884

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/132675/

Comments