MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3f8019ba1f837f109cf75b3aeb84e79900030e8f098302490dd7bca4d2345b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3f8019ba1f837f109cf75b3aeb84e79900030e8f098302490dd7bca4d2345b0
SHA3-384 hash: ff48e52254fb153b1bbf5d33e0f80c49b07d96f4483fb164c7856ea18612a0f3b621e726d920601a508376dc79b1ff97
SHA1 hash: afe20d323afd03c154c1902c579690d1abdd53e4
MD5 hash: bce0641169963d3a42c86e0bd7840409
humanhash: emma-carolina-don-island
File name:Invoice_61461.vbs
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:7'762 bytes
First seen:2021-09-24 18:26:25 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 96:PXNTJhS9INIKMVGQRX8+HLz9spiINIVIWjnCQRX8Lnaa:PXNT2INIRRX8+Hm4INIVI8xRXAx
Threatray 1'486 similar samples on MalwareBazaar
TLSH T167F12F3CEA037ADD741D5E2D09CB77295A10C0B5C953E6F9C740FAAC69EEB40AB51238
Reporter abuse_ch
Tags:AsyncRAT RAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191236/
Detection(s):
SecuriteInfo.com.VB.Trojan.Valyria.5344.300.32199.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/857541
Signature
Creates an undocumented autostart registry key
Sigma detected: CrackMapExec PowerShell Obfuscation
VBScript performs obfuscated calls to suspicious functions
Very long command line found
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3f8019ba1f837f109cf75b3aeb84e79900030e8f098302490dd7bca4d2345b0/
Threat name:
Script-WScript.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2021-09-24 18:27:07 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yp4adg5b7a37ccopowz25ocopgiaamhi6cmdajeq3v54utjdiwya._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0741c36ad10f51f858eefc2e2f0879c9ef1ae90af61d766bd50ebcc67f4d5579
AsyncRAT
12f2e964639c39076f29196264c1dcbd3792eaaaa77aca14986a802a122b341b
AsyncRAT
486b4fcc5a6e4f4e949aa11aa3f2e9d8d2075ac8445617af8c41ab214f6dbfa0
AsyncRAT
51e6527daa5a10028c434c7ceaed1570ddd95e1de0eafa702f77860cec3d0b7c
AsyncRAT
70c61a7220e7df5841fded5bafa8340c388440911f8c894b35872188f300f29d
AsyncRAT
766d8e9d2d0de0a0ba2440a847e7eb7da3e69d51331e15a61ec1d25d3d92fc3e
AsyncRAT
831d7b676bb75c44df50f40798fe739cb07d4c0b1ee217a7e8fea443f7b00346
AsyncRAT
ecfaef9e7fc7c83be8beedfcbef268c3d5a91a904ed211fa553c9e9b6aaa9c42
AsyncRAT
ffec1862f56857ad722abbcb98be7af86f2cf0763371bcb40273f0d884157c32
AsyncRAT
+ 1'476 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/210924-w3q96aheen/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Blocklisted process makes network request
Async RAT payload
AsyncRat
Malware Config
Dropper Extraction:
http://104.41.205.251/dashboard/majit.txt
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c3f8019ba1f8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3f8019ba1f837f109cf75b3aeb84e79900030e8f098302490dd7bca4d2345b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_B64_Artifacts
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Rule name:INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
Create hunting rule
Author:ditekSHen
Description:Detects executables attemping to enumerate video devices using WMI
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/191236/

Comments