MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f99cf4e79efb37bea41405c5701f8ce7f86dea17a05b0c89f8f775c28458b214. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	f99cf4e79efb37bea41405c5701f8ce7f86dea17a05b0c89f8f775c28458b214
SHA3-384 hash:	9b5258dc1fb6bdf551ff513de4d34c7c0f8a370c09c970992312182bebc400fefa93bf7f1c30aa69b42a669bb02b5307
SHA1 hash:	ddcce8e6877df1162aa3b8e3c0796e726fa2d611
MD5 hash:	469f99c8e3a52be01da2ef4e89b526e7
humanhash:	nevada-lactose-black-seven
File name:	469f99c8e3a52be01da2ef4e89b526e7.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	2'085'520 bytes
First seen:	2022-12-01 15:57:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4385a52c4954ea622602f131b43369ce (2 x AsyncRAT, 1 x RedLineStealer, 1 x RemcosRAT)
ssdeep	49152:X54hFcwNeJM01aHZTdGL/eCJpLK6dc3JjfhtHXgqTn6Ctz:p4LzNeqmiTdyeMx2ZnXxTnlF
TLSH	T1D7A52305A752DFB6E9A20931CD53937115AFBD75CB30DA83B39562A92C709C3CE62383
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	dcf2f0dcdcf2f2dc (1 x ArkeiStealer, 1 x SystemBC, 1 x AsyncRAT)
Reporter	abuse_ch
Tags:	AsyncRAT exe signed

Code Signing Certificate

Organisation:	copylink.net
Issuer:	Go Daddy Secure Certificate Authority - G2
Algorithm:	sha256WithRSAEncryption
Valid from:	2021-11-16T21:11:11Z
Valid to:	2022-12-18T21:11:11Z
Serial number:	1077e01b6f03bdb4
Intelligence:	2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	fd6eef00d3d722f0c046a7d6c73ce8ae911e3ab3b156238c7a3e6ca0160006d9
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

175

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

469f99c8e3a52be01da2ef4e89b526e7.exe

Verdict:

Malicious activity

Analysis date:

2022-12-01 16:05:00 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/05364442-bb8d-4dd1-b847-fb678519b289

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/341211/

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Creating a window

Searching for the window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Сreating synchronization primitives

Creating a file

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware overlay packed

Link:

https://www.filescan.io/uploads/6388cf0c40937912f4965dbe/reports/4d1b17a0-85cf-4f06-818c-b22a47782d85/overview

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/cd49bed2-a0a8-4043-b49a-28205436e69d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f99cf4e79efb37bea41405c5701f8ce7f86dea17a05b0c89f8f775c28458b214/

Threat name:

Win32.Trojan.Strab

Status:

Malicious

First seen:

2022-12-01 15:58:17 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

9 of 26 (34.62%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7gopjz467m335jauaxcxah4m474g32qxubnqzcpy6524fbcywika._file

Verdict:

malicious

Label(s):

asyncrat

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/221201-teh8jadh84/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8303a18e-cbe6-4969-82c3-833c06f2c161

Unpacked files

SH256 hash:

b4301ae4eae3bb97635b0f70ffd7fca5ffd862f53c410f266abfc6bf490caccb

MD5 hash:

832c312dc8e5b65eccee477e0ed47763

SHA1 hash:

f83bd21871c660ca55e126ff043f35910a0cba6e

Link:

https://www.unpac.me/results/07bca224-9c97-4b6e-9f28-87eb1e997787/

SH256 hash:

f99cf4e79efb37bea41405c5701f8ce7f86dea17a05b0c89f8f775c28458b214

MD5 hash:

469f99c8e3a52be01da2ef4e89b526e7

SHA1 hash:

ddcce8e6877df1162aa3b8e3c0796e726fa2d611

Link:

https://www.unpac.me/results/07bca224-9c97-4b6e-9f28-87eb1e997787/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f99cf4e79efb37bea41405c5701f8ce7f86dea17a05b0c89f8f775c28458b214

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.