MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbd91445baa27c316821c545a5aef3079d7bed7beac77de667f88d1617439215. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbd91445baa27c316821c545a5aef3079d7bed7beac77de667f88d1617439215
SHA3-384 hash: d021cc4fd38fe71e77dd79f0e2254bad3b03710df3c982b9501720471110f292af918dadd7ded21d78d91f4d20f52504
SHA1 hash: ad492cae70d6f50d3a9350c7c229caf52f3326b0
MD5 hash: 2925d1fcffa92336d1231f135615795c
humanhash: iowa-early-single-sweet
File name:Procurcon.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:268'800 bytes
First seen:2020-07-22 08:40:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'606 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:q6A9jUTkYCWZlx2GhNorFBREQiXtA4pSMpe5Q:NAiY/elx2iNoZvEtAO9
Threatray 588 similar samples on MalwareBazaar
TLSH 5C44BE1CBFD15439C23E0BFB88E3149052B5B153B522EF1F28C5A578CE5368A6BC259B
Reporter whitehoodie4
Tags:AsyncRAT asynrat


Avatar
whitehoodie4
HELO domain: server.fco.pt
Sender's IP address: 151.236.39.153


Jó nap,
Kérjük, adja meg ezeknek a termékeknek a legjobb árait, ahogyan azt a vásárlási okmány tartalmazza.
Üdvözlettel.

https://nyschool.edu.sg/Procurcon.iso

József Kovács
H-1141 Budapest,
Jeszenák János utca 85.
+36 30 940 1705, +36 30 212 7880
info@procurcon.hu

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Ispy
Create hunting rule
Link:
https://www.capesandbox.com/analysis/30952/
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Njrat.27483.11837.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Running batch commands
Launching a process
Creating a file in the %AppData% directory
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
81 / 100
Link:
https://www.joesandbox.com/analysis/394728
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 249769 Sample: Procurcon.exe Startdate: 23/07/2020 Architecture: WINDOWS Score: 81 31 Antivirus detection for dropped file 2->31 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for dropped file 2->35 37 6 other signatures 2->37 7 Procurcon.exe 3 7 2->7         started        10 OpenWith.exe 18 6 2->10         started        12 pcalua.exe 1 2->12         started        14 2 other processes 2->14 process3 file4 23 C:\Users\user\AppData\Roaming\uhujui, PE32 7->23 dropped 25 C:\Users\user\...\uhujui:Zone.Identifier, ASCII 7->25 dropped 27 C:\Users\user\AppData\...\Procurcon.exe.log, ASCII 7->27 dropped 29 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 7->29 dropped 16 cmd.exe 1 7->16         started        process5 process6 18 reg.exe 1 1 16->18         started        21 conhost.exe 16->21         started        signatures7 39 Creates an autostart registry key pointing to binary in C:\Windows 18->39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbd91445baa27c316821c545a5aef3079d7bed7beac77de667f88d1617439215/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 08:42:07 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
19d23d06b49ced25b47d72f5338af4fa1fc533cce85dcaff4286e0da31054a38
AsyncRAT
1cf9635133972859e226ccff6a787c9bb8d2ca6471ae5a9650b3841625072444
AsyncRAT
32ec92b57297749ae4e4cc6299579355e77573ffdf0b125d1f65ebcc62b9fbfb
AsyncRAT
49a63eb1c6fd5d4b22396bb8a8397c3bf124c3f94d104bc2a7a304f4457b4526
AsyncRAT
581d4ba63e52707e1839c7d2c026c847d788b8b3025046bdb491f95a431ca1f7
AsyncRAT
5da82dd52f913ff5d416ec5479133a0f89cd5d835d2fbd964f32191f642ca9fa
AsyncRAT
83ef26bdf4b6b513417a97c8997aa2152bc0fb0f0af9d0b30cf6a46d4959ce38
AsyncRAT
a8e43601776f927b6f02d5c473ae0caa3f686b948236c94a377b68fc9aaff830
AsyncRAT
c926c7de61dd7fe8057e5142bbf2263004191728bc8ba132136a2fc4b7353584
AsyncRAT
d7b0f275997cb07e5a97600fb21eb19d14096352af7990797f863b74941a1603
AsyncRAT
+ 578 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200722-py8y78aqh6/
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bbd91445baa27c316821c545a5aef3079d7bed7beac77de667f88d1617439215

File information

The table below shows additional information about this malware sample such as delivery method and external references.

AsyncRAT

Executable exe bbd91445baa27c316821c545a5aef3079d7bed7beac77de667f88d1617439215

(this sample)

cc0099e93f84e9b352d1bdbb3fa6489f3a8f17d21f3c2f69f7f7a63972bac23e

anyrun
any.run
https://app.any.run/tasks/c712cb3b-8305-410b-af49-a3973b1435f7
  
Dropping
SHA256 cc0099e93f84e9b352d1bdbb3fa6489f3a8f17d21f3c2f69f7f7a63972bac23e
  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/30952/

Comments