MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dea0baa27b4aec785704292890f0c33261fbf51e1cd857c39f563e36251b6430. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dea0baa27b4aec785704292890f0c33261fbf51e1cd857c39f563e36251b6430
SHA3-384 hash: f8c9e25d300f4ce6876421102f102ced787ef0dcc730e2514f39dfef0de9971070ca6a5c6e968634bc4d27417a33b097
SHA1 hash: 3e158ac1149277ac5afc3937644fc3e9b48a2c26
MD5 hash: 0320bf3e8314fa2f5f4d78c8a69d5aef
humanhash: seventeen-seventeen-carolina-papa
File name:SKM-2000012.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:16'384 bytes
First seen:2022-09-29 08:18:13 UTC
Last seen:2022-10-08 03:23:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 192:BINVpJODMlmDJLMl3F8EfqD1Y9HJ2HoaNj4s3n61B2KWW40W6:qLODZLMl3epkHAHvNj4ZaW40W
Threatray 2'474 similar samples on MalwareBazaar
TLSH T1D172D8005688D2A1E4BFC77B7482EB231A6DAED5BB1E866D27003C099F356D37E13719
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 0c3cfcfc3c410000 (1 x AsyncRAT, 1 x PureCrypter, 1 x AgentTesla)
Reporter GovCERT_CH
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
6
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/314633/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.9433.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/633554f782a207eb42e9246e/reports/c8737f90-e8a2-4b07-b865-93e10ec85497/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c1adea7f-c6a9-4e37-8afa-6b473d9e9d53
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1079837
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Passes username and password via HTTP get
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses dynamic DNS services
Uses the Telegram API (likely for C&C communication)
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
Yara detected Telegram RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 712394 Sample: SKM-2000012.exe Startdate: 29/09/2022 Architecture: WINDOWS Score: 100 39 api.telegram.org 2->39 41 api.anonfile.com 2->41 55 Snort IDS alert for network traffic 2->55 57 Multi AV Scanner detection for domain / URL 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 11 other signatures 2->61 8 SKM-2000012.exe 16 7 2->8         started        13 Ftzuby.exe 14 2 2->13         started        15 Ftzuby.exe 2->15         started        signatures3 process4 dnsIp5 43 api.telegram.org 149.154.167.220, 443, 49696, 49704 TELEGRAMRU United Kingdom 8->43 45 crbsas.com 67.225.176.158, 443, 49692, 49697 LIQUIDWEBUS United States 8->45 27 C:\Users\user\AppData\Roaming\...\Ftzuby.exe, PE32 8->27 dropped 29 C:\Users\user\...\Ftzuby.exe:Zone.Identifier, ASCII 8->29 dropped 31 C:\Users\user\AppData\...\SKM-2000012.exe.log, ASCII 8->31 dropped 63 Encrypted powershell cmdline option found 8->63 65 Injects a PE file into a foreign processes 8->65 17 SKM-2000012.exe 14 8->17         started        21 SKM-2000012.exe 2 8->21         started        23 powershell.exe 16 8->23         started        67 Multi AV Scanner detection for dropped file 13->67 69 Machine Learning detection for dropped file 13->69 47 192.168.2.1 unknown unknown 15->47 file6 signatures7 process8 dnsIp9 33 freegeoip.app 188.114.97.3, 443, 49701 CLOUDFLARENETUS European Union 17->33 35 ipbase.com 99.83.231.61, 443, 49702 AMAZON-02US United States 17->35 49 Tries to steal Mail credentials (via file / registry access) 17->49 51 Tries to harvest and steal browser information (history, passwords, etc) 17->51 53 Tries to harvest and steal Bitcoin Wallet information 17->53 37 severdops.ddns.net 208.67.106.143, 49698, 6204 GRAYSON-COLLIN-COMMUNICATIONSUS United States 21->37 25 conhost.exe 23->25         started        signatures10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dea0baa27b4aec785704292890f0c33261fbf51e1cd857c39f563e36251b6430/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-09-28 14:12:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32qlvit3jlwhqvyefeujb4gdgjq7x5i6dtmfpq47ky7dmji3mqya._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
07f2d4559c633807609f3169ccbc9bfa83d68791984cd52d519a46a738a676d1
AsyncRAT
0ab6fc39f65f1c1d2196dcaa8ded12df941a3051c523d902f4e6458bd40a9e7a
AsyncRAT
250aff2c3a55a4d8ad9a091d1794ae9717f6a6d4e00c0e8be853cbca5d4681a3
AsyncRAT
3852b464e5ee957cb10980de453b0813036c06c0fb6157ba236b895870d67e82
AsyncRAT
3d5194f12c6b21b79d636f65e29f308aad0bfdd1cd7e00c54cb8488b1867ff9f
AsyncRAT
55b9b380e7b5173e1481af8f2379a2490f54dfef43324ed9dc71e21a48207a9a
AsyncRAT
6d62cebf308b5ab873d98e0447c68f936bc34addeb924eb8ef972072ca13d4bf
AsyncRAT
b12ed3f10bbc4e4ade3f53856b19c7ab878eb023389a8b6c4c3c495a0ea97f86
AsyncRAT
d8b8f7d0334857a3749963c08491c155c6743af96f8ad779101060ff71a9eca3
AsyncRAT
+ 2'464 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat collection persistence rat spyware stealer
Link:
https://tria.ge/reports/220929-j7vf6aabd9/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Looks up external IP address via web service
Checks computer location settings
Reads user/profile data of web browsers
AsyncRat
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/60142fba-aa90-4a10-9afa-7dcfec850cb2
Unpacked files
SH256 hash:
dea0baa27b4aec785704292890f0c33261fbf51e1cd857c39f563e36251b6430
MD5 hash:
0320bf3e8314fa2f5f4d78c8a69d5aef
SHA1 hash:
3e158ac1149277ac5afc3937644fc3e9b48a2c26
Link:
https://www.unpac.me/results/3a57a742-74fc-44ee-b4f3-4b23122c6c41/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dea0baa27b4a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/dea0baa27b4aec785704292890f0c33261fbf51e1cd857c39f563e36251b6430

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

Executable exe dea0baa27b4aec785704292890f0c33261fbf51e1cd857c39f563e36251b6430

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/314633/

Comments