MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9a566c94783c5d9f75b0f98c1310e05e5968b35b5229b07b7a54ea072890399. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	f9a566c94783c5d9f75b0f98c1310e05e5968b35b5229b07b7a54ea072890399
SHA3-384 hash:	f340b36ed211018a7e00a97052bbaaa7794d5779c00274b89da0e55770236610800fd71c7088fcf6b5963f796ccd8494
SHA1 hash:	200febbe1c918c982e0c37ec045b79d56dcc4256
MD5 hash:	93550d0ac9c874ff0fe3e3904d9287ac
humanhash:	comet-saturn-single-nitrogen
File name:	90W.ps1
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	5'840'889 bytes
First seen:	2022-02-22 19:11:53 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24576:MPryW3GF/TM9IG9L9ZlR7FJfSvrl+sUic7Za0aFg4bkcOFIk86q5hpmqP147IR/l:h
Threatray	1'247 similar samples on MalwareBazaar
TLSH	T110461961FC30B6A2ED85D28E645552DFF92903A3B350043532EEF619851ACBAF78FB44
Reporter	adm1n_usa32
Tags:	AsyncRAT powershell ps1

Intelligence

File Origin

# of uploads :

# of downloads :

352

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Script.Oneeva.Aml.9100.25764.UNOFFICIAL

Result

Verdict:

UNKNOWN

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9a566c94783c5d9f75b0f98c1310e05e5968b35b5229b07b7a54ea072890399/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2022-02-22 19:12:14 UTC

File Type:

Text (PowerShell)

AV detection:

9 of 27 (33.33%)

Threat level:

5/5

Verdict:

unknown

AsyncRAT

1b956ea6626165956ea897d431801376e7189f96e149de1b2ee2fed6944a38b2

AsyncRAT

32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559

AsyncRAT

3d030fbfbe328bc4f276d565854f89189094ddb46dc1c6d36e8e9a438227279f

AsyncRAT

4ab15234cdc0baf746b77352e6d47af4643544c48c32653bd215c6e5296b6f3c

AsyncRAT

81fe52e70e3f0562d02591313a49d2b353bedc557fcc09d3d6093160de68f3d0

AsyncRAT

914cd602a58f69dd35dd207d8128807926a139f27f4d8b7b2b958041783bc10c

AsyncRAT

92d30855da0de535afe7d2b432108880f5d3766767c09c493defcb6c05c10448

AsyncRAT

cdf45f57fd8885bea02e2fcaf7b3a13c3f8185827cee1ef348a22cb36c1886c0

AsyncRAT

eb24b3b9375f0b3272fac6eecc9329f79eab274d802b2ad37037cc83a46fa3f1

AsyncRAT

+ 1'237 additional samples on MalwareBazaar

Result

Malware family:

asyncrat

Score:

10/10

Tags:

family:asyncrat botnet:default rat

Link:

https://tria.ge/reports/220222-xwhj4scfd5/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops file in System32 directory

Suspicious use of SetThreadContext

Async RAT payload

AsyncRat

Process spawned unexpected child process

Malware Config

C2 Extraction:

asyncmoney.duckdns.org:7829
asyncmoney.duckdns.org:7840
asyncmoney.duckdns.org:7841
asyncmoney.duckdns.org:7842
asyncmoney.duckdns.org:7849
asyncpcc.duckdns.org:7829
asyncpcc.duckdns.org:7840
asyncpcc.duckdns.org:7841
asyncpcc.duckdns.org:7842
asyncpcc.duckdns.org:7849
monedfghsja.duckdns.org:7829
monedfghsja.duckdns.org:7840
monedfghsja.duckdns.org:7841
monedfghsja.duckdns.org:7842
monedfghsja.duckdns.org:7849

Malware family:

AsyncRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/f9a566c94783/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f9a566c94783c5d9f75b0f98c1310e05e5968b35b5229b07b7a54ea072890399

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.