MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff
SHA3-384 hash:	0ff1e5148c92ed78f44799477ee651f1a1ac9fa1660c71eb7dd4c61af5e5132a1ecef263b807b4ae05be1afc8ac2a17b
SHA1 hash:	fa39a3bb823909c0294804a32303378ac25e0492
MD5 hash:	524fca1eea0f55f1ad6281325664dcb4
humanhash:	oklahoma-lima-dakota-uniform
File name:	sfqbr.ps1
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	22'030 bytes
First seen:	2025-01-07 05:10:18 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	384:zIAXUpjxl+K++gtu0P1GUK++qUpjxl6Upjxl+mATyK++IcmATpPsPWmATEP9rPva:zIAMVl+7+gbh7+3VlnVliTy7+IITJqKh
Threatray	22 similar samples on MalwareBazaar
TLSH	T1E6A28E7B91C070C77FAE7B505BF7ADD7BAF2143E619820EC6965C132932B84890091E3
Magika	txt
Reporter	zhuzhu0009
Tags:	AsyncRAT ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

129

Origin country :

PL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677cb834ffdcee13ec857145

Tags:

autorun shell agent sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

obfuscated persistence

Link:

https://www.filescan.io/uploads/677cb76788fd5a33f1be930b/reports/9c31a956-5409-4fe4-bbae-3d3689702569/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox DcRat, KeyLogger, StormKitty, Strela Ste

Result

Threat name:

DcRat, KeyLogger, StormKitty, Strela Ste

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1585139

Signature

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Antivirus detection for dropped file

Bypasses PowerShell execution policy

Compiles code for process injection (via .Net compiler)

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Drops script at startup location

Sigma detected: Powerup Write Hijack DLL

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected DcRat

Yara detected Generic Downloader

Yara detected Keylogger Generic

Yara detected Powershell decode and execute

Yara detected Powershell download and execute

Yara detected StormKitty Stealer

Yara detected Strela Stealer

Yara detected VenomRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

51%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-01-07 05:11:03 UTC

File Type:

Text (PowerShell)

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wyqhtpqvk3mwqznddeuzkkx6zz4dkimoosfixod2vg3kmyxclp7q._file

Threatray stormkitty asyncrat

Verdict:

malicious

Label(s):

stormkitty

Alert

Create hunting rule

asyncrat

Alert

Create hunting rule

Similar samples:

2b07a75b74b701d95f6957416959df359f441e7455e933913208891f05c6c9e5

AsyncRAT

5605af6e3cba4057057a8cc765f94d1112d1a147171e056b1bdfcc3b38a056f0

AsyncRAT

5d8b55532cda3855a8211e70366648a22ef5193dd36931fa61e3393290c2ada9

AsyncRAT

5e8a676a5b37f85a09339873a139a73268662b1c0bfe94d764bbfffec60ea196

AsyncRAT

616666d9b60d1c211b76fac927651e82dbe9fc4d62d296b7e55950ab56cdf2a5

AsyncRAT

9c2838e120c7ed5b582bedc6177f14a52aa578adeea269d0f96fc71a95bd6e68

AsyncRAT

ad822394ecd393272d3d1ba77306e502ee90259f4c328dab80e9d6b5e4bd363f

AsyncRAT

e0cc614e2c756bfe9eb3773daa8d6c0ac66a2902826f5ccbd94113e3ff69e3db

AsyncRAT

error

AsyncRAT

+ 12 additional samples on MalwareBazaar

Hatching Triage stormkitty

Result

Malware family:

stormkitty

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat family:stormkitty discovery execution rat stealer

Link:

https://tria.ge/reports/250107-ft9gdawjct/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks installed software on the system

Drops startup file

Blocklisted process makes network request

Downloads MZ/PE file

AsyncRat

Asyncrat family

StormKitty

StormKitty payload

Stormkitty family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/b62079be1556d96865a31929952afece7835218e748a8bb87aa9b6a662e25bff