MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2cdc3a3e85a67ca00f8c7898c95132b8e1061576f83249e60a292c3ffb93f3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 7

Intelligence 7 IOCs 1 YARA 9 File information Comments

SHA256 hash:	b2cdc3a3e85a67ca00f8c7898c95132b8e1061576f83249e60a292c3ffb93f3f
SHA3-384 hash:	d6be96207f8654b9c1e55ee1df5577fa5da8159d3b48874ce4b61bb83510e4886bae34994d9348af0b18361cbe62978c
SHA1 hash:	af8b49054caf2f9972868b10259060fe5ca43a50
MD5 hash:	14840aee4d09f3a7eac95d4bcbdb8ccc
humanhash:	ack-nebraska-zebra-stream
File name:	RFQ#0003725812.pdf.z
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	428'855 bytes
First seen:	2023-05-02 19:15:54 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:+qqIBo3nBTRxgeVY/Ls//iclMoIcjzWmj:nqIQnTieuFH6z7j
TLSH	T1F99423137CE1579A4C7662F477F3D1B941F138D2A6E33E5AE283E20A53C994EC62D890
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AsyncRAT QUOTATION RFQ z

cocaman

Malicious email (T1566.001)
From: ""ARIVU ASHOK" <arivu@brightsun.com.sg>" (likely spoofed)
Received: "from brightsun.com.sg (unknown [95.214.27.226]) "
Date: "2 May 2023 08:06:07 -0700"
Subject: "REQUEST FOR QUOTATION"
Attachment: "RFQ#0003725812.pdf.z"

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
95.214.27.226:6606	https://threatfox.abuse.ch/ioc/1109526/

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	RFQ#0003725812.pdf.exe
File size:	992'768 bytes
SHA256 hash:	c72e8271a4eb3c18cd2f83c50acd4d1b77f162be15b2011aa384eab178a7d51d
MD5 hash:	d7a342009bfd76a907b3f2baf9acb1d8
MIME type:	application/x-dosexec
Signature	AsyncRAT

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

golang packed

Link:

https://www.filescan.io/uploads/645161743d47a64d306ba67e/reports/8fcb3701-7b70-434f-b3d5-5b33527effd4/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/b2cdc3a3e85a67ca00f8c7898c95132b8e1061576f83249e60a292c3ffb93f3f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b2cdc3a3e85a67ca00f8c7898c95132b8e1061576f83249e60a292c3ffb93f3f/

Threat name:

Win64.Backdoor.AsyncRAT

Status:

Malicious

First seen:

2023-05-02 11:58:48 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wlg4hi7iljt4uahyy6eyzfitfohbaykxn6bsjhtaukjmh75zh47q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AsyncRAT

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b2cdc3a3e85a67ca00f8c7898c95132b8e1061576f83249e60a292c3ffb93f3f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research