🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c62ef09ac5b47ea517047fd3719bb2e93b37b97f4c7477198c4b4d2383c227b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c62ef09ac5b47ea517047fd3719bb2e93b37b97f4c7477198c4b4d2383c227b6
SHA3-384 hash: 2869320ab3d438c6eb3d54829fa21a3b4474549ce2649552a2407da67b074763caa370d11865d99a4678a64a89c7cebf
SHA1 hash: 2cb8e4535503aee6d9e24ed6a5c4bc45ab7dd071
MD5 hash: 4fb6199509a8edbf44569fdfbdf3bed0
humanhash: cola-autumn-nineteen-lima
File name:IMG_Mia_Khlifa_20220603.vbs
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'849'454 bytes
First seen:2023-01-15 14:01:29 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 12288:WDDPUUMMzMlZl+lZl+lZl+lZl+lZl+lZl+lZl+lZl+lZl+lZl+lZl+lZl+lZl+lW:MsRBpX
TLSH T1B985108799412CAB1D9342F36C1F18F6B92660D616160420FF4DB4A8173979FA7FA2CF
Reporter abuse_ch
Tags:AsyncRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/353111/
Detection(s):
Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VBS.Shell-14.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63c4075c71fb096abeedaf2c/reports/2cd6bdd9-dc8f-4788-9971-9bd08c8be1e5/overview
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1151921
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
DLL side loading technique detected
Drops VBS files to the startup folder
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
VBScript performs obfuscated calls to suspicious functions
Windows Shell Script Host drops VBS files
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 784652 Sample: IMG_Mia_Khlifa_20220603.vbs Startdate: 15/01/2023 Architecture: WINDOWS Score: 100 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for dropped file 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 4 other signatures 2->44 7 wscript.exe 10 2->7         started        11 wscript.exe 7 2->11         started        process3 file4 30 IMG_Mia_Khlifa_202...vbs:Zone.Identifier, ASCII 7->30 dropped 32 C:\Users\user\...\IMG_Mia_Khlifa_20220603.vbs, ASCII 7->32 dropped 46 VBScript performs obfuscated calls to suspicious functions 7->46 48 Windows Shell Script Host drops VBS files 7->48 50 Drops VBS files to the startup folder 7->50 13 wscript.exe 10 7->13         started        52 Wscript called in batch mode (surpress errors) 11->52 17 wscript.exe 7 11->17         started        signatures5 process6 file7 34 C:\Users\user\AppData\Local\...\dynwrapx.dll, PE32 13->34 dropped 54 VBScript performs obfuscated calls to suspicious functions 13->54 19 regsvr32.exe 2 13->19         started        56 Writes to foreign memory regions 17->56 58 Allocates memory in foreign processes 17->58 60 DLL side loading technique detected 17->60 62 Injects a PE file into a foreign processes 17->62 21 RegAsm.exe 2 17->21         started        24 RegAsm.exe 3 17->24         started        26 RegAsm.exe 2 17->26         started        28 3 other processes 17->28 signatures8 process9 dnsIp10 36 141.95.84.40, 3060, 49706, 49707 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 21->36
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c62ef09ac5b47ea517047fd3719bb2e93b37b97f4c7477198c4b4d2383c227b6/
Threat name:
Script.Trojan.Emeka
Create hunting rule
Status:
Malicious
First seen:
2023-01-14 20:32:12 UTC
File Type:
Text (VBS)
AV detection:
6 of 26 (23.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yyxpbgwfwr7kkfyep7jxdg5s5e5tpol7jr2hogmmjngsha6ce63a._file
Verdict:
malicious
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:newyourk persistence rat
Link:
https://tria.ge/reports/230115-rb4zqabe3t/
Behaviour
Modifies registry class
Modifies system certificate store
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Registers COM server for autorun
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
141.95.84.40:3060
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c62ef09ac5b4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c62ef09ac5b47ea517047fd3719bb2e93b37b97f4c7477198c4b4d2383c227b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/353111/

Comments