MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e1422dbc6631aec397fe0dc7298ec6b52570720f2fb6c7605db0a72b48809df9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AsyncRAT
Vendor detections: 8
| SHA256 hash: | e1422dbc6631aec397fe0dc7298ec6b52570720f2fb6c7605db0a72b48809df9 |
|---|---|
| SHA3-384 hash: | 6dbbaf4c62e2c78576b8da1876ab151dceeda4560ed7c1973fb575bc94ffcb2ab5ce2931c6c32f0e666f072ed0bd128e |
| SHA1 hash: | b93da2a3260f0b3197f0dc8f15bd2720ea7906ed |
| MD5 hash: | 94e3fdc74425a4bb8a876372eb352726 |
| humanhash: | arizona-lemon-black-sodium |
| File name: | NEW-ORDER_020939434.exe |
| Download: | download sample |
| Signature | AsyncRAT |
| File size: | 460'648 bytes |
| First seen: | 2020-10-13 14:53:25 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger) |
| ssdeep | 6144:/r25JvXa8ErPamCAcxRIbzhHIGrI3Qfr+MRo5qicNfT/SsBBjxk:TbzhHnZfr+H5yNj9W |
| Threatray | 15 similar samples on MalwareBazaar |
| TLSH | 58A41A36DC55DA32FCBD6B72F4745AEA9E209D0D7C02EE0E41415EAB6D2EFC1180B918 |
| Reporter |  abuse_ch |
| Tags: | AsyncRAT exe |
abuse_ch
Malspam distributing unidentified malware:HELO: ir-linux01.ihglobaldns.com
Sending IP: 185.10.73.91
From: sales <m-mahdavi@arsamplast.com>
Subject: New-ORDER - Quotation Request
Attachment: NEW-ORDER_020939434.lzh (contains "NEW-ORDER_020939434.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Launching a process
DNS request
Connection attempt to an infection source
Enabling autorun by creating a file
Result
Threat name:
AsyncRAT
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
Adds a directory exclusion to Windows Defender
Creates an undocumented autostart registry key
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Quasar
Status:
Malicious
First seen:
2020-10-13 11:08:27 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 5 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Score:
10/10
Tags:
rat family:asyncrat
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
AsyncRat
Unpacked files
SH256 hash:
464a8bf404ef6023676312d1f96cca54b449d0ea341d9f6fe01a199979f72e43
MD5 hash:
5f7dcddae6ad425c4ac59f645e1d48f6
SHA1 hash:
1764b9f55ebb996b988f6c00c89ea9c1a84bf49f
Detections:
win_asyncrat_w0
SH256 hash:
6620213752313348f91961b165eac6b00d3adef775ee0b01861a7dafaa1bf35d
MD5 hash:
941a85633e4399dc81a681032e635dc5
SHA1 hash:
f2da5db4940bcb410200af00b29197d259848235
SH256 hash:
e1422dbc6631aec397fe0dc7298ec6b52570720f2fb6c7605db0a72b48809df9
MD5 hash:
94e3fdc74425a4bb8a876372eb352726
SHA1 hash:
b93da2a3260f0b3197f0dc8f15bd2720ea7906ed
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.