MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee5d1f995e8d669ab4c9273672b02af132b998e009088e7598c3e97d6d370d0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee5d1f995e8d669ab4c9273672b02af132b998e009088e7598c3e97d6d370d0e
SHA3-384 hash: 0d49a919704e79efe5e177264eddabff523f75d6ee57813993290279a97a08940aabd0cee1e822495e7e8d6047e2013f
SHA1 hash: 763e452abdd7834dce89d510cd80624d65f8fda9
MD5 hash: 1e99cdb0dd7b2391f1d75f8138108485
humanhash: bravo-lake-arkansas-music
File name:FedEx's AWB#5305323204643.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:204'800 bytes
First seen:2020-09-16 06:04:51 UTC
Last seen:2020-09-16 12:26:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 3072:WQbYxbEV2AyO4slPqCM4saRROeFDcTZaASvPiyolAmJuLIJxUZUqdPFyTwWbdi:WQbGb6t7QSvKpg6+KcPsTwM
Threatray 341 similar samples on MalwareBazaar
TLSH 57148DEE3A5E446FCD6A027F515A40C0F83166C73654ADCEB1BE830C1D1BACB9B5178A
Reporter cocaman
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
AsyncRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/61511/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop13.65479.3524.19785.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Sending a UDP request
Creating a file
Running batch commands
Launching a process
Creating a file in the %AppData% directory
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Result
Threat name:
AsyncRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/467507
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Creates an autostart registry key pointing to binary in C:\Windows
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Add file from suspicious location to autostart registry
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected AsyncRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 286163 Sample: FedEx's AWB#5305323204643.exe Startdate: 16/09/2020 Architecture: WINDOWS Score: 100 32 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->32 34 Multi AV Scanner detection for submitted file 2->34 36 Yara detected AntiVM_3 2->36 38 6 other signatures 2->38 7 FedEx's AWB#5305323204643.exe 9 2->7         started        10 pcalua.exe 1 1 2->10         started        process3 file4 24 C:\Users\user\AppData\Roaming\dwrn.exe, PE32 7->24 dropped 26 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 7->26 dropped 28 C:\Users\user\...\dwrn.exe:Zone.Identifier, ASCII 7->28 dropped 30 2 other files (1 malicious) 7->30 dropped 12 dwrn.exe 3 7->12         started        15 cmd.exe 1 7->15         started        process5 signatures6 42 Multi AV Scanner detection for dropped file 12->42 44 Machine Learning detection for dropped file 12->44 46 Writes to foreign memory regions 12->46 48 3 other signatures 12->48 17 AddInProcess32.exe 12->17         started        19 reg.exe 1 1 15->19         started        22 conhost.exe 15->22         started        process7 signatures8 40 Creates an autostart registry key pointing to binary in C:\Windows 19->40
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee5d1f995e8d669ab4c9273672b02af132b998e009088e7598c3e97d6d370d0e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-09-16 03:56:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5zor7gk6rvtjvngje43hfmbk6ezltghabeei45myypux23jxbuha._file
Verdict:
suspicious
Similar samples:
0442367788ead3ccf0c9a36805053be48c332ab656f51667f4c08cbbfa3f3ac0
AsyncRAT
1463ba2b7707a1d561524bdb93fcf638696d540fd4535ee754dfd1a994809fea
AsyncRAT
2c8c5c5e5990da4a2af218cfece6afda3f4830be6605b9767adbfbde2e5cd276
AsyncRAT
62afb1cbcacb77aa2ca99cc55c0e3536738415289f53c4a3a57d9b9cc08ee5ab
AsyncRAT
80f341333728513fea45dc07c8582e5a8c3ac630de39b53ef23d1742ddc0f5d2
AsyncRAT
885179565290381c8e8e883f1e4c776507c1ddd3bfa8902f432ea31fbf01c683
AsyncRAT
923909fa41e21d68dbc11443fe31cf99d2792014767e276dd9aa7289a78afa06
AsyncRAT
99afa20e22dac4e8fd5f536c3fd6c806fa6a9f52a0458c0c1a90fdc3e8a1f3f8
AsyncRAT
acdef12ec35b82f310c535d3cf08f81d60f1090a25e243772ac5086992104421
AsyncRAT
dba9ab278a6ff48c2119f65e8824b32e1df9d6a9e586828ca3641d34abe3e938
AsyncRAT
+ 331 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
rat persistence family:asyncrat
Link:
https://tria.ge/reports/200916-t3bwsde5h6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Executes dropped EXE
Async RAT payload
AsyncRat
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee5d1f995e8d669ab4c9273672b02af132b998e009088e7598c3e97d6d370d0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/61511/

Comments