MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca32420160b4ba9b029fdc12df95d54c10c2dd7d878265026a461125c6dba745. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 7


Intelligence 7 IOCs 1 YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca32420160b4ba9b029fdc12df95d54c10c2dd7d878265026a461125c6dba745
SHA3-384 hash: c223bff6fe8a769378539ec513ab0103db97bf74e3b6b86b80c38b4cf326065821277f00736b1a5b43e1cb802d40c03a
SHA1 hash: 2d33bfd11bfb64d616ed711699c5c701fba14896
MD5 hash: 9743f6d9eb73fbea512fc1cdbaae4587
humanhash: foxtrot-magnesium-bacon-uniform
File name:WinZa.zip
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:2'524'879 bytes
First seen:2023-05-02 05:46:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:LMzQeJkWPRom6HjX+/o9z8NlWyOVsDVqE:UQONopHT+5N4VAVB
TLSH T151C51225F84A6E61FC8CCDF94AF0BDA403E46C78007A56D41374355FABABB5E9920E34
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter lowmal3
Tags:AsyncRAT file-pumped zip

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
95.214.27.226:7707 https://threatfox.abuse.ch/ioc/1109527/

Intelligence

File Origin
# of uploads :
1
# of downloads :
542
Origin country :
DE DE
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:WinZa.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:1'560'358'912 bytes
SHA256 hash: d34b9b54bfc0200632b8f0859108f4c5e64939b859d4e1ece478be630083251f
MD5 hash: 3a091fd28145e8b8f1c92b8444015845
De-pumped file size:992'768 bytes (Vs. original size of 1'560'358'912 bytes)
De-pumped SHA256 hash: fd927ccd954b92b1ee0b6695108361066b74dccb7bafe5dd0a7cb37147af1c84
De-pumped MD5 hash: 60048276bc28ab0b9fa976a535a36562
MIME type:application/x-dosexec
Signature AsyncRAT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.56514.29804.4113.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
ZIP File - Malicious
Link:
https://app.docguard.net/ca32420160b4ba9b029fdc12df95d54c10c2dd7d878265026a461125c6dba745/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Gathering data
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/ca32420160b4ba9b029fdc12df95d54c10c2dd7d878265026a461125c6dba745
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/ca32420160b4ba9b029fdc12df95d54c10c2dd7d878265026a461125c6dba745
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca32420160b4ba9b029fdc12df95d54c10c2dd7d878265026a461125c6dba745/
Threat name:
Binary.Trojan.Pumpar
Create hunting rule
Status:
Malicious
First seen:
2023-05-01 03:18:12 UTC
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zizeealaws5jwau73qjn7fovjqimfxl5q6bgkatkiyislrw3u5cq._file
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/230502-gx6qbsbg3y/
Behaviour
Suspicious use of AdjustPrivilegeToken
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
95.214.27.226:6606
95.214.27.226:7707
95.214.27.226:8808
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:PK_PUMP_AND_DUMP
Create hunting rule
Author:Will Metcalf @node5
Description:Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size
Rule name:weird_zip_high_compression_ratio
Create hunting rule
Author:Maxime THIEBAUT (@0xThiebaut)
Description:Detects single-entry ZIP files with a suspiciously high compression ratio (>100:1) and decompressed size above the 500MB AV limit
Reference:https://twitter.com/Cryptolaemus1/status/1633099154623803394

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments