MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902
SHA3-384 hash: a6fc39ac23b70ccc6af26ca62a8206be2892ecf434f2e6fc1fd181bdd14a88dbea9899c9e13e020971094b69768083f6
SHA1 hash: cb4c7535da5bcfc2a59c9a173602421b8b38957c
MD5 hash: 85eadd379714196df5b223c64110c799
humanhash: connecticut-seven-spaghetti-spaghetti
File name:Faturas pagaspdf.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:505'856 bytes
First seen:2023-05-11 17:25:40 UTC
Last seen:2023-05-13 22:51:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:GJAwhh2Y4YB8+i1izKoy6j+sBrz4LvBxvQOuRJ:Bwhh2K8HanE9lQjr
Threatray 1'078 similar samples on MalwareBazaar
TLSH T1BEB4C09682B88F01CA6D4BFE4C93C28606F499717C25EA311FC728CD9DB392E64585FD
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
141.98.102.235:16296

Intelligence

File Origin
# of uploads :
2
# of downloads :
298
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
Faturas pagaspdf.exe
Verdict:
Malicious activity
Analysis date:
2023-05-11 17:26:48 UTC
Tags:
trojan rat asyncrat
Link:
https://app.any.run/tasks/987f238b-d5b7-4514-a1bc-d07569807924

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/388450/
Detection(s):
Sanesecurity.Malware.28872.BadIN4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
barys comodo lokibot packed
Link:
https://www.filescan.io/uploads/645d252d8723e91f55259d21/reports/8110f701-1217-4d4c-8bbb-494b95c1323c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8d41bf31-f0bb-432c-8e34-6590a0933433
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1230965
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AsyncRAT
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 863947 Sample: Faturas_pagaspdf.exe Startdate: 11/05/2023 Architecture: WINDOWS Score: 100 46 Snort IDS alert for network traffic 2->46 48 Found malware configuration 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 7 other signatures 2->52 7 Faturas_pagaspdf.exe 7 2->7         started        11 AhulwmZLgEIpSc.exe 5 2->11         started        process3 file4 36 C:\Users\user\AppData\...\AhulwmZLgEIpSc.exe, PE32 7->36 dropped 38 C:\...\AhulwmZLgEIpSc.exe:Zone.Identifier, ASCII 7->38 dropped 40 C:\Users\user\AppData\Local\...\tmpFEAA.tmp, XML 7->40 dropped 42 C:\Users\user\...\Faturas_pagaspdf.exe.log, ASCII 7->42 dropped 54 Uses schtasks.exe or at.exe to add and modify task schedules 7->54 56 Adds a directory exclusion to Windows Defender 7->56 13 RegSvcs.exe 2 7->13         started        16 powershell.exe 20 7->16         started        18 powershell.exe 21 7->18         started        24 2 other processes 7->24 58 Multi AV Scanner detection for dropped file 11->58 60 Machine Learning detection for dropped file 11->60 20 schtasks.exe 11->20         started        22 RegSvcs.exe 11->22         started        signatures5 process6 dnsIp7 44 141.98.102.235, 16296, 49704 M247GB Romania 13->44 26 conhost.exe 16->26         started        28 conhost.exe 16->28         started        30 conhost.exe 18->30         started        32 conhost.exe 20->32         started        34 conhost.exe 24->34         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2023-05-11 17:26:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6t46iunatfoef7greqx62ubb5laumbto47dr7xqjwpeqpdm5eba._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
114f4e62ec2b81ab45799a56b183ef282b2bc5c172fd9831af33c154b23034ea
AsyncRAT
203495007a95ee6a8fd76e9e4b910e55c7126c1484a31b464b3f5206c6bfa388
AsyncRAT
21a5e58e2fe39e481f9977f94a94d352c4c492e9bd6d79d4ae3bbf4cc4a2d751
AsyncRAT
2484f3b9e112f39471b0375d98ac190b4ffe3e29a295bcecdb8fd7b71af0094b
AsyncRAT
4634594a43ca9d6f4630aecf8a17a04a1b2e942cafa3080a4064e2ec7741bd5f
AsyncRAT
4b81215a34d41cbdfa37fa7b93710ed6ddaea795f793740c9da1fe04366893b0
AsyncRAT
6053c5c3a4202b8c2e6b2f176a99c980233f63024be06b67d3a30e2f0b4470f4
AsyncRAT
8e3f656f70978440245c238870f316ccdbfbadff73350dd6d204c9035cc00357
AsyncRAT
92d153f7f41fa901887ec1494773140e4ef9b41378f2ec05deeb0ad8ec3f5d16
AsyncRAT
+ 1'068 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/230511-vzvbzagh24/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
141.98.102.235:16296
Unpacked files
SH256 hash:
c474cdbfc20a6b7dd07c1dca20653107a866779fc189948c485e8dbfc6bf901b
MD5 hash:
844836b3c2a31e188c04c3191049abcb
SHA1 hash:
f6ace5263ef966466da4794c68ff3db0a6f42fb6
Link:
https://www.unpac.me/results/712b1c64-80f7-4e32-95a5-f928d1801994/
SH256 hash:
3ab1dcc37e7c5c643bf41e9f0f81f816f24974fbddde95e2af52426e3374dd35
MD5 hash:
8a2c496875c0871aecc16aae768b323f
SHA1 hash:
f5423a32125c70b512de301c5616c7b75477e2e7
Link:
https://www.unpac.me/results/712b1c64-80f7-4e32-95a5-f928d1801994/
SH256 hash:
e8da228276b29553360c1f4cd5c8a842e1396fe1666122b26fc37b2be65f75a4
MD5 hash:
739327e716699c512f6a4a77185dde18
SHA1 hash:
d92b08ce9ef2db241339f2d5aa1ad3d9dccb51d5
Link:
https://www.unpac.me/results/712b1c64-80f7-4e32-95a5-f928d1801994/
SH256 hash:
53f16e1a6b4bd51b16ea6d92bef70785d4cb647962ad2a9b48937cb147b8e971
MD5 hash:
2e6734e596402bc8851b85318735a0eb
SHA1 hash:
92f52d7f91fc02bbb3c2a3de096a1c779cc8fad7
Link:
https://www.unpac.me/results/712b1c64-80f7-4e32-95a5-f928d1801994/
SH256 hash:
58d3964ae9072f10b748e71fa90a6bad6c42712b811f3f142c4a2df020ca84e1
MD5 hash:
11415bdb2b581770893315f8f8412c9a
SHA1 hash:
2294c355643aeefc7545607e412fcc7d7dbbb210
Detections:
AsyncRAT
Create hunting rule
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/712b1c64-80f7-4e32-95a5-f928d1801994/
Parent samples :
c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902
5d318ad1fa11ca3660fe35faff0e0aaef8acd820e01cdd5ee7305c30314f5303
a242d05d9234c40a82be642ceb1c6e4ee4b5ff008ced528553f1cd104a6fd82c
SH256 hash:
c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902
MD5 hash:
85eadd379714196df5b223c64110c799
SHA1 hash:
cb4c7535da5bcfc2a59c9a173602421b8b38957c
Link:
https://www.unpac.me/results/712b1c64-80f7-4e32-95a5-f928d1801994/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c7a7cf228d04/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AsyncRat
Create hunting rule
Author:kevoreilly, JPCERT/CC Incident Response Group
Description:AsyncRat Payload
Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:malware_asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:MAL_AsnycRAT
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:MAL_AsyncRAT_Config_Decryption
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:SUSP_Reverse_Run_Key
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a Reversed Run Key
Rule name:Windows_Trojan_Asyncrat_11a11ba1
Create hunting rule
Author:Elastic Security
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/388450/

Comments