MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed77428124df77e71916701501c30ad35e7d3ee17572aa705e989f8b786cbe20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QNodeService


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed77428124df77e71916701501c30ad35e7d3ee17572aa705e989f8b786cbe20
SHA3-384 hash: 7b2c9fb54512b6a2f5093f7ce32bbb7572ea2a5def9ecb1759bf91eb29ed9f8c1ff6f46b245fdaf9a0f538e9d0c17109
SHA1 hash: e1378bf432db9c5b4453cd62bf35f99c08ab0a65
MD5 hash: 90a0e47f0bd69bdade317bdf239a86f7
humanhash: delta-kilo-carolina-hamper
File name:01_extracted.exe
Download: download sample
Signature QNodeService
Create hunting rule
File size:842'240 bytes
First seen:2021-02-17 23:22:24 UTC
Last seen:2021-02-18 01:14:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:upCYmT8DUjwtcTtg5tp83CBSS5UkX7QxKUk8PxLgiBb5e4Fq/OIhqwyQR+YVd4O3:brS5UknU/giBb5ZF1VB9O+m
Threatray 6 similar samples on MalwareBazaar
TLSH 0F05D8931394BF54E1BD573455A1740883F3ECCEE7A9CA4DFDE930CA23B2B80A596612
Reporter Racco42
Tags:exe QNodeService

Intelligence

File Origin
# of uploads :
2
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117625/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.73048.9620.19744.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/610965
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed77428124df77e71916701501c30ad35e7d3ee17572aa705e989f8b786cbe20/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 23:23:05 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5v3ufaje3536ogiwoakqdqyk2nph2pxbovzku4c6tcpyw6dmxyqa._file
Verdict:
unknown
Similar samples:
9d6c737ffe3b5886f36b9883b3019361fc286845616dc9a757dde4b78901239b
QNodeService
9e38c0c3c516583da526016c4c6a671c53333d3d156562717db79eac63587522
QNodeService
b7100d4e869329857f90ba16e477f2c4c48c5727d22fbbe1527000e99c447ece
QNodeService
e015205a8b0f863e9251c8cfddcba5cd3947a0def0470dbf705aa7fd57e13840
QNodeService
e2e5d2cb61ec3f3f01e17ac8dff23a4e1cbfd9059e9b58646e68a757a1cc976d
QNodeService
fb4eed3cf47b8b977f61b307651cadf7e5f18e4fa20e91239e1f9832fc5d822c
QNodeService
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/210217-zdmldglfws/
Behaviour
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
severdops.ddns.net:6204
Unpacked files
SH256 hash:
b2499a2af35b550fbe7f541a14ff1225e1202324f351eecf85de6c8e9fc7c27c
MD5 hash:
5e732e4265622675313195dead01047e
SHA1 hash:
359c710a93c2f58cdc2a45de8dd48a6884a70645
Link:
https://www.unpac.me/results/2607292e-cc13-42a8-a716-58314cea51f5/
SH256 hash:
ed77428124df77e71916701501c30ad35e7d3ee17572aa705e989f8b786cbe20
MD5 hash:
90a0e47f0bd69bdade317bdf239a86f7
SHA1 hash:
e1378bf432db9c5b4453cd62bf35f99c08ab0a65
Link:
https://www.unpac.me/results/2607292e-cc13-42a8-a716-58314cea51f5/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:Reverse_text_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Reverse text detected
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/117625/

Comments