MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments 1

SHA256 hash:	ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6
SHA3-384 hash:	89bf9c3738a8b735d3ce1e3c99cf3d2522c54a7a317bda30fae1440b5de53e7c61a2531b9f5c3c11484a971aaa6f8241
SHA1 hash:	d9d22d2a7428d76cfd16ee01db9f8fb183012a14
MD5 hash:	5ae3dd349f2353e1693d6390f054366f
humanhash:	blossom-music-arkansas-sweet
File name:	5ae3dd349f2353e1693d6390f054366f
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	2'717'184 bytes
First seen:	2023-01-25 09:27:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	49152:rJXCD8nskw910xxQIcZ42V4XLjZcd5IzgK/sdZvaKBaJh:8I
Threatray	2'903 similar samples on MalwareBazaar
TLSH	T12BC5F1710787FFE6E3BB1E7890042D408C6524539F78D6A8BDCC25AF61E5634EA98B70
TrID	56.5% (.EXE) Win64 Executable (generic) (10523/12/4) 11.0% (.ICL) Windows Icons Library (generic) (2059/9) 10.9% (.EXE) OS/2 Executable (generic) (2029/13) 10.7% (.EXE) Generic Win/DOS Executable (2002/3) 10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	b870e0848cdcf030 (2 x AsyncRAT)
Reporter	zbetcheckin
Tags:	AsyncRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

243

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

5ae3dd349f2353e1693d6390f054366f

Verdict:

Malicious activity

Analysis date:

2023-01-25 09:29:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/84572f72-3d8d-4bca-8e0e-d78183ed75e8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

zgRAT

Link:

https://www.capesandbox.com/analysis/356659/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Sending a custom TCP request

Launching a process

Creating a process with a hidden window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/63d0f626696b2d972574589d/reports/7d2f26d9-9c40-477e-afec-f7408155e5ef/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Formbook

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/690f0fd1-f079-4ee6-b598-e2ad2f77c344

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1158572

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Encrypted powershell cmdline option found

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Costura Assembly Loader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6/

Threat name:

Win64.Trojan.Nekark

Status:

Malicious

First seen:

2023-01-23 17:38:16 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

17 of 39 (43.59%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zjadhwycxxwsoookjyy4okiq4tczsx4ug7g2brdwpkargftnqs3a._file

Verdict:

malicious

Label(s):

asyncrat

AsyncRAT

5e6776ba02afa4c03138edcdf1e10dabee3efd6afd1620dcdb3138e7632bcb79

AsyncRAT

7d78760bb50c4e3b9f29c9d507b8c593a8497eda54285358c948577f27c71820

AsyncRAT

a3375e8060a51acf467e9659bc9d73ead727bb7cdf0258c0d8d5fa19887658aa

AsyncRAT

c8b995746f09979fc1ccd83a08dab8913aa88b9036b584cc60d72029e867dd1d

AsyncRAT

d0d03da3e2d11c18da8588b4061ea885005160f3bfb0f30f62aa582285ed2e9f

AsyncRAT

ffe2e43e59074cf27875cc31e8be84503b1a6854dd3f2480b5aff7b6b220a416

AsyncRAT

+ 2'893 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner

Link:

https://tria.ge/reports/230125-lfbk3sfe94/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in System32 directory

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

XMRig Miner payload

xmrig

Unpacked files

SH256 hash:

ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6

MD5 hash:

5ae3dd349f2353e1693d6390f054366f

SHA1 hash:

d9d22d2a7428d76cfd16ee01db9f8fb183012a14

Link:

https://www.unpac.me/results/d63598c2-4824-4f79-b9e0-d295a3e1e797/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/ca4033db02bded2739ca4e31c72910e4c5995f9437cda0c4767a8113166d84b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.