MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e
SHA3-384 hash: ddf3d04699d8e4e9e6dd180c78e81d1711715f3a976e53bce4fb43c640b1921bcdcc00c1f29100e53de9a76bf7a6af59
SHA1 hash: 12ffe4b71bdda14909f5d88301597f9cdf75ff94
MD5 hash: dd505f7c59aa2882633c01034428e952
humanhash: missouri-golf-juliet-spaghetti
File name:hkcmd.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:708'096 bytes
First seen:2023-06-05 14:06:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:SrgDkO3hHlWxMzIHREJVk/bq4izoW/m7GloyLwo6s7pSCpCETtwpkZQ6b98I:SMA4hHlWxMiQW/O4ue7koUos1JpfhkX4
Threatray 2'251 similar samples on MalwareBazaar
TLSH T188E4F10872FADB19D47A7FFC089095B083F0A25A7156E74A4EC378DE5E74B418F0299B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon e08c0f2322073bc0 (10 x AgentTesla, 6 x Formbook, 3 x SnakeKeylogger)
Reporter James_inthe_box
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
US US
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
hkcmd.exe
Verdict:
Malicious activity
Analysis date:
2023-06-05 14:09:49 UTC
Tags:
asyncrat
Link:
https://app.any.run/tasks/33aa8a27-3388-4ec1-ace9-ee80ad02e549

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/395806/
Detection(s):
SecuriteInfo.com.Trojan.Siggen20.58076.20342.17976.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Creating a process with a hidden window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin packed
Link:
https://www.filescan.io/uploads/647dec0792c8bde26f231aa1/reports/7446a6c5-b2b2-4925-912b-a124cf4574fd/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/047a64dd-30af-4122-997b-1ed819dda4ec
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1248822
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AsyncRAT
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 881839 Sample: hkcmd.exe Startdate: 05/06/2023 Architecture: WINDOWS Score: 100 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Sigma detected: Scheduled temp file as task from temp location 2->46 48 6 other signatures 2->48 7 hkcmd.exe 7 2->7         started        11 RjBtcy.exe 5 2->11         started        process3 file4 32 C:\Users\user\AppData\Roaming\RjBtcy.exe, PE32 7->32 dropped 34 C:\Users\user\...\RjBtcy.exe:Zone.Identifier, ASCII 7->34 dropped 36 C:\Users\user\AppData\Local\...\tmp4498.tmp, XML 7->36 dropped 38 C:\Users\user\AppData\Local\...\hkcmd.exe.log, ASCII 7->38 dropped 50 Uses schtasks.exe or at.exe to add and modify task schedules 7->50 52 Adds a directory exclusion to Windows Defender 7->52 54 Injects a PE file into a foreign processes 7->54 13 hkcmd.exe 2 7->13         started        16 powershell.exe 20 7->16         started        18 schtasks.exe 1 7->18         started        56 Multi AV Scanner detection for dropped file 11->56 58 Machine Learning detection for dropped file 11->58 20 schtasks.exe 1 11->20         started        22 RjBtcy.exe 2 11->22         started        24 RjBtcy.exe 11->24         started        signatures5 process6 dnsIp7 40 191.101.130.205, 6606, 7707, 8808 MAJESTIC-HOSTING-01US Chile 13->40 26 conhost.exe 16->26         started        28 conhost.exe 18->28         started        30 conhost.exe 20->30         started        process8
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e/
Threat name:
Win32.Backdoor.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2023-06-05 14:05:34 UTC
File Type:
PE (.Net Exe)
Extracted files:
24
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ynz63kl7gijxzqhh22lwfvxesucjy6t25n254wp5ym7koghtr7a._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
111c25bd4cd2f4771e7fec9e564c623218e06eb1b9d839cf58a9f117b4979ac0
AsyncRAT
225b5222006b81872d4a02968f11227da74152b1835738911b11c74b867e091c
AsyncRAT
265239e9f3afc31425ff40cae955be249c0f2251437ed837a1c4567069fabce8
AsyncRAT
76f01e4cfcfc115b4c26f3cae977d3390a6d205ed9ac87c74d471b3dda4bd4a2
AsyncRAT
c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902
AsyncRAT
cf44163e574fb84c598bd3a738aac3119c0f64cc7c6fce5739faca7ea9158bcc
AsyncRAT
de4e83422e4f28ede29ee71e76da0bafc7436f8a18d4845eda47be1a4e3ec2b8
AsyncRAT
e1a441bbf7f86c4a4ae14f1a62301dffeef1261a53e6829eaa9085d666e14bf1
AsyncRAT
e40bff3bb093b2bdc11d7e1d5a990db99b3a914dc74a1aec2d28662da10cde9b
AsyncRAT
e7257b2ef7c6b3b168ad3671313943edd71572ac24421d765890a878a67556bb
AsyncRAT
+ 2'241 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default rat
Link:
https://tria.ge/reports/230605-rey8msha35/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
191.101.130.205:6606
191.101.130.205:7707
191.101.130.205:8808
Unpacked files
SH256 hash:
e20dc956f68ade1a86ba247b44780714198cb31de43d8ed26498cf554fcf2815
MD5 hash:
6f9229a09da13bf564afb3d31bfbfcfb
SHA1 hash:
f8db65cd61388d5720bcc3e912beae6490c9dc2e
Link:
https://www.unpac.me/results/49c367a0-4dfc-4f26-a23c-4ca6ccde1eb7/
SH256 hash:
2f13f4db3405dfac3dd2945be3de440607b6e8479951c2630823009700083953
MD5 hash:
084fd7e237ece48508277cdfd578e47d
SHA1 hash:
f152839ca9518552e41320c8b3bab96d01a911e5
Link:
https://www.unpac.me/results/49c367a0-4dfc-4f26-a23c-4ca6ccde1eb7/
SH256 hash:
8367c23191b8d227cbbf40d65de6c970dda4081f902155946ae2eb856ee6186b
MD5 hash:
697a6e83589cfe54e1ffe0107b1a56fb
SHA1 hash:
e96fa62dc378cae7d5fc331e916c3c0060d1ac70
Detections:
AsyncRAT
Create hunting rule
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/49c367a0-4dfc-4f26-a23c-4ca6ccde1eb7/
SH256 hash:
c440617e04a50ced73c8ab992cbe8d8954a3e41f21f046ee9d1f2a41ea9b416d
MD5 hash:
9390df6c9a6111978dee5414bc42eda6
SHA1 hash:
d3cb1c366b9e466afa93eb369838a04d30777795
Link:
https://www.unpac.me/results/49c367a0-4dfc-4f26-a23c-4ca6ccde1eb7/
SH256 hash:
56fb1d3be26cbd11d591a65d4dd60cf684a0fc7adff32a891ba62682c91511d6
MD5 hash:
2cefb8f4336ef23b7421d959e5e33e14
SHA1 hash:
8b9cbfb850033acf59fa0de0aaf84472e23b520a
Link:
https://www.unpac.me/results/49c367a0-4dfc-4f26-a23c-4ca6ccde1eb7/
SH256 hash:
de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e
MD5 hash:
dd505f7c59aa2882633c01034428e952
SHA1 hash:
12ffe4b71bdda14909f5d88301597f9cdf75ff94
Link:
https://www.unpac.me/results/49c367a0-4dfc-4f26-a23c-4ca6ccde1eb7/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/de1b9f6d4bf9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/de1b9f6d4bf9909be6073eb4bb16b724a824e3d3d75baef2cfee19f538c79c7e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AsyncRat
Create hunting rule
Author:kevoreilly, JPCERT/CC Incident Response Group
Description:AsyncRat Payload
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:malware_asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:MAL_AsnycRAT
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:MAL_AsyncRAT_Config_Decryption
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:SUSP_Reverse_Run_Key
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a Reversed Run Key
Rule name:Windows_Trojan_Asyncrat_11a11ba1
Create hunting rule
Author:Elastic Security
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/395806/
  
URLhaus
https://urlhaus.abuse.ch/url/2652924/

Comments