MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2e31ed9833299ec3c166877db92ff5d477858f5867ca5494b26a82558e4616e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2e31ed9833299ec3c166877db92ff5d477858f5867ca5494b26a82558e4616e
SHA3-384 hash: 74f0b3ab3b68aa5dd1fb3410a88d63f3dfd425241c00fe1896df4c27a92854ba0715dba8d1187222f915430435d0810a
SHA1 hash: d2018825de87bb722a83c38f3708cc5360ac903a
MD5 hash: de93a55f646cd1e6c317365db8561d16
humanhash: gee-thirteen-mars-georgia
File name:de93a55f646cd1e6c317365db8561d16.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:251'392 bytes
First seen:2022-09-29 10:48:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 384:77/k+XBcW0kFXP4WGzvsuj8Sf5dCuEMa/qunCmtJdh5R555Do:7X70s6bdCjquRr5R555c
Threatray 3'030 similar samples on MalwareBazaar
TLSH T1E434A5B57643A412F86E06F40E88C57316236E96EA51C25E37DE7F8F3A312EEC560360
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon c6c7cbd991b10810 (3 x AsyncRAT, 2 x SnakeKeylogger, 2 x PureMiner)
Reporter abuse_ch
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
http://194.38.23.170/loader/uploads/new.exe
Verdict:
Malicious activity
Analysis date:
2022-09-27 18:38:11 UTC
Tags:
loader
Link:
https://app.any.run/tasks/15282a40-4e58-489b-a17e-abc495d76c30

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/314725/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP GET request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed remcos
Link:
https://www.filescan.io/uploads/6335781e896404d760d779be/reports/5aa759a2-c3c0-46c2-a972-8b6228859f21/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e3529538-5aa7-4184-bc99-cd6496f26a06
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1079980
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2e31ed9833299ec3c166877db92ff5d477858f5867ca5494b26a82558e4616e/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-09-27 22:03:29 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wlrr5wmdgkm6ypawnb35xex7lvdxqwhvqz6kkskle2uckwhemfxa._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
070fabea4042e858bc95a0e9d34ed2ecfd1ce74fdc20975d4089249e198f69f9
AsyncRAT
0e3e160ddaa8d68817083c0af379a529fe607c414bb9a9befed895ad7f9d3b38
AsyncRAT
7efc5412627522e01e6be72ff0d8528c7cb140cf741e61458d50b653242e2b76
AsyncRAT
8fcafbce9965e41f0788634133b69cd42bebc118aa2a5b8da11842b1e088ebb2
AsyncRAT
9ed63d5d2012e6db4c9f48b3c8b97b8645f0efc7f98f6a07c42feb9688c5b838
AsyncRAT
ab91459253a14ca086ed1b79f0958b331fc09b7d611ef953ca85c045ff43024e
AsyncRAT
ba7668b41ac8a2295eaa9a02952ff8b5947782b77645f53e06fbb3bb33c110df
AsyncRAT
+ 3'020 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220929-mwnq1sbefj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/791e0a52-3ef0-4dad-816c-95cd54a44f27
Unpacked files
SH256 hash:
b2e31ed9833299ec3c166877db92ff5d477858f5867ca5494b26a82558e4616e
MD5 hash:
de93a55f646cd1e6c317365db8561d16
SHA1 hash:
d2018825de87bb722a83c38f3708cc5360ac903a
Link:
https://www.unpac.me/results/5e7ad29a-2dbe-4221-a980-e9de015b8f1e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2e31ed9833299ec3c166877db92ff5d477858f5867ca5494b26a82558e4616e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe b2e31ed9833299ec3c166877db92ff5d477858f5867ca5494b26a82558e4616e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2306837/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2307201/
Cape
Cape
https://www.capesandbox.com/analysis/314725/

Comments