MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f744c46e4c678d65d9682a0f42dc2b82277ea2d879eeb3d708fb70af2af40a94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f744c46e4c678d65d9682a0f42dc2b82277ea2d879eeb3d708fb70af2af40a94
SHA3-384 hash: 9f23ea344ce45eae89ed8a1d8c2080873976c7ca0142b79f72c4e9371ff1b363d58289af0edeccebfeec5bea4f985635
SHA1 hash: bced873bf58c79d2787d8ea501e7888b260d36f6
MD5 hash: 3717491f7b1a90aaa5f271ab14147a9b
humanhash: ten-oklahoma-spaghetti-juliet
File name:Logger.dll
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:29'184 bytes
First seen:2022-10-21 06:32:33 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 384:KyQLebQc3aImZ5mzk2yKajPdseXGLN0phDbuAyso4bNmLaNDNCsQKbQr1jIC8:/i/bbUyPMeBbI1AQ50C8
Threatray 3'013 similar samples on MalwareBazaar
TLSH T1F5D22A066B54E377DBDC1BB8A86313010775C1A7A903EBCA6CA460F60A173DB27256DF
TrID 28.6% (.SCR) Windows screen saver (13101/52/3)
22.9% (.EXE) Win64 Executable (generic) (10523/12/4)
14.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
11.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter JAMESWT_WT
Tags:AsyncRAT dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/322195/
Detection(s):
Win.Malware.Bulz-9946739-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/63523d1fb87ce1b32f7916e7/reports/4601c10e-7146-4273-90f4-2cc85a3f06dc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a70ba8d2-8548-4333-8d9d-08d215bbe1ea
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1094657
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 727295 Sample: Logger.dll Startdate: 21/10/2022 Architecture: WINDOWS Score: 64 15 Antivirus / Scanner detection for submitted sample 2->15 17 Multi AV Scanner detection for submitted file 2->17 19 Machine Learning detection for sample 2->19 21 Contains functionality to log keystrokes (.Net Source) 2->21 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        process5 13 rundll32.exe 9->13         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f744c46e4c678d65d9682a0f42dc2b82277ea2d879eeb3d708fb70af2af40a94/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-03-07 23:58:23 UTC
File Type:
PE (.Net Dll)
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=65cmi3smm6gwlwlifihufxblqitx5iwyphxlhvyi7nyk6kxubkka._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
072d48161b09b35ea7f698a4dd7708005e2c39ce96fde8dd140da5d3ff900c54
AsyncRAT
14be9c3ff0aaccd55a2fc7b17fe63009ae3a746c28623efd8a7e66150f715a32
AsyncRAT
168f62c6ea11a386469563c360ee5517da31015e774ccc9c8ba3d1bd4b4f45ef
AsyncRAT
50f93055604c7418fa0e5536afd0b4d535db752b5e7edf588cbc14c1570613a1
AsyncRAT
85641fdd05980c31b2e8d6d3f6218391dd089780df85a53e24a1f3f0abdf6a24
AsyncRAT
9fbfd1036e579edc9498625e86c45743e4ad8ecf5960f4a87a9402ba1236448f
AsyncRAT
dae673b838de497c1aa8a558d4dd5963d90e8b21538cb0d9adce585ef6fbc915
AsyncRAT
dfa246c2763bf5df442a81128b3587f7bf530e4327f631cdd4dd79106738cf31
AsyncRAT
e74d874a3667feac3a7a9e1f7052c7d6bd77996e6c7b87abb480d5d945cfc233
AsyncRAT
+ 3'003 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat rat
Link:
https://tria.ge/reports/221021-ha6x9affhj/
Unpacked files
SH256 hash:
f744c46e4c678d65d9682a0f42dc2b82277ea2d879eeb3d708fb70af2af40a94
MD5 hash:
3717491f7b1a90aaa5f271ab14147a9b
SHA1 hash:
bced873bf58c79d2787d8ea501e7888b260d36f6
Link:
https://www.unpac.me/results/25aeb8ef-0673-4a6f-9d23-4ed71916a478/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f744c46e4c678d65d9682a0f42dc2b82277ea2d879eeb3d708fb70af2af40a94

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/322195/

Comments