MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffead35df6bc101476d76393619fe0a06a57d93927417d9bcf814d2e4c6b36a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffead35df6bc101476d76393619fe0a06a57d93927417d9bcf814d2e4c6b36a0
SHA3-384 hash: 39ddbce1062c934813f432f3f7184e207e42bacd85acb40f7df13c7ba7d49436e8b7f0c69a5a51db030e35d28194422f
SHA1 hash: e60cf5e718c030182dec6f7fbbbbf884fcdfcca1
MD5 hash: 6f6b812c166e53dc9b52b9b60e5ed369
humanhash: stream-violet-high-nineteen
File name:lcomplcmpo.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:15'375'360 bytes
First seen:2022-12-05 06:48:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 98304:YxPSlTK4rzJ7WH1jbqWpAFyLDEJLbYaqizJMsv2VRs7m4PDv1wmTfXlQ4ImVhwI:0PST7yxWM4nYaqilMsvkRsDCMfXZI8w
Threatray 2'249 similar samples on MalwareBazaar
TLSH T158F6FB9C726072DFC857D472DEA82DA8EA5178BB931F4203902715ADEE4D89BDF140F2
TrID 73.8% (.RLL) Microsoft Resource Library (x86) (177572/6/26)
12.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
4.3% (.EXE) Win64 Executable (generic) (10523/12/4)
2.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:AsyncRAT exe RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
197
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
lcomplcmpo.exe
Verdict:
Malicious activity
Analysis date:
2022-11-05 03:23:16 UTC
Tags:
asyncrat
Link:
https://app.any.run/tasks/30e5130d-2d6c-412e-92f1-814913ba662a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.MSILPerseus.238084.27635.24462.UNOFFICIAL
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Enabling the 'hidden' option for analyzed file
Launching a process
Creating a file
Сreating synchronization primitives
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
confuserex ieexec.exe packed shell32.dll stealer
Link:
https://www.filescan.io/uploads/638d946004e0e79bdf40dfca/reports/17665bfc-52f0-45e3-9bd7-1b3161717e34/overview
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d0568eca-0658-4663-9f01-b84fc3049278
Result
Threat name:
AsyncRAT, PhoenixRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1127765
Signature
Detected unpacking (changes PE section rights)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AsyncRAT
Yara detected Generic Downloader
Yara detected PhoenixRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 760489 Sample: lcomplcmpo.exe Startdate: 05/12/2022 Architecture: WINDOWS Score: 100 36 Malicious sample detected (through community Yara rule) 2->36 38 Multi AV Scanner detection for submitted file 2->38 40 Yara detected PhoenixRAT 2->40 42 6 other signatures 2->42 6 lcomplcmpo.exe 3 2->6         started        10 lcomplcmpo.exe 2 2->10         started        12 lcomplcmpo.exe 2 2->12         started        14 lcomplcmpo.exe 2 2->14         started        process3 file4 32 C:\Users\user\AppData\...\lcomplcmpo.exe.log, ASCII 6->32 dropped 44 Detected unpacking (changes PE section rights) 6->44 16 RegAsm.exe 2 6->16         started        19 WerFault.exe 10 10->19         started        22 WerFault.exe 10 12->22         started        24 WerFault.exe 3 10 14->24         started        signatures5 process6 dnsIp7 34 217.64.31.3, 8437 BAKINTER-ASBakinternetISPAzerbaijanAZ Azerbaijan 16->34 26 C:\ProgramData\Microsoft\...\Report.wer, Unicode 19->26 dropped 28 C:\ProgramData\Microsoft\...\Report.wer, Unicode 22->28 dropped 30 C:\ProgramData\Microsoft\...\Report.wer, Unicode 24->30 dropped file8
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ffead35df6bc101476d76393619fe0a06a57d93927417d9bcf814d2e4c6b36a0/
Threat name:
Win32.Backdoor.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2022-11-05 06:25:10 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
28 of 41 (68.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=77vngxpwxqibi5wxmojwdh7aubvfpwjze5ax3g6pqfgs4tdlg2qa._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0fe7eb794d5cd8304eda8d15e03c5427790c42726fbd3205fef2e3ee14a64dcb
AsyncRAT
399a0e77326dc484fa92fd5f95f2dbd89866dfd4e7e80661634a9a83f0652403
AsyncRAT
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42
AsyncRAT
79e8e0b6c7226ecbc6c3bf02486f76fc78bed83141b33f5341eeaf1ebef27b27
AsyncRAT
c8a05d068f0325e63c8964274949828710fb95880e939c2c3da06a1396a11aac
AsyncRAT
ef9609169903222818592b43043f38b4ad40190c5bc400b7e0af96a90b085c3c
AsyncRAT
+ 2'239 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:defendersmartscren rat
Link:
https://tria.ge/reports/221205-hlctjsee62/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Executes dropped EXE
Async RAT payload
AsyncRat
Malware Config
C2 Extraction:
217.64.31.3:8437
Unpacked files
SH256 hash:
b761d6eac815a0bb592d78545a3af690eb9f46eaa65c9cc2d96ef2e0dbf6afbf
MD5 hash:
ace99a468a7a57549a1060dcd9937777
SHA1 hash:
eb62b235f4e1b5669874f6cbe6a0eacffee9edb5
Link:
https://www.unpac.me/results/291f5866-5a4b-45c4-9ce2-3a4a22943bf4/
SH256 hash:
cecba741cddd5a98be026683a24cdfd42b0d820057a709cd4bda7d693f943400
MD5 hash:
34db01f9e3bd7014076bb9dcf94095c0
SHA1 hash:
d881ba0a2d79e73a0f772ce490fd46c6cf16ef6d
Link:
https://www.unpac.me/results/291f5866-5a4b-45c4-9ce2-3a4a22943bf4/
SH256 hash:
505f991758d80fcea2477e3ae04e50ef7bf571065aea7a95ac3d4a3f2e3d1f0c
MD5 hash:
e8f756cf5566a5ed1a82c89f36350c35
SHA1 hash:
8656c016e27055f5135faf65b3ca742a08e57b22
Detections:
AsyncRAT
Create hunting rule
win_asyncrat_w0
Create hunting rule
Link:
https://www.unpac.me/results/291f5866-5a4b-45c4-9ce2-3a4a22943bf4/
Parent samples :
db805d5ac09ea9d18a3016d4c70cbb52087604fe5ad23fd8043399c970c0c8a6
ffead35df6bc101476d76393619fe0a06a57d93927417d9bcf814d2e4c6b36a0
0f9616033c3e2c3df40e50ccf9cbe8ffb0954569acb29f9bfb5e18d7c431254d
ea9a3686784c9990761ae93d2a99fdf2bd2a4270119068542ef018e8f248432e
SH256 hash:
ffead35df6bc101476d76393619fe0a06a57d93927417d9bcf814d2e4c6b36a0
MD5 hash:
6f6b812c166e53dc9b52b9b60e5ed369
SHA1 hash:
e60cf5e718c030182dec6f7fbbbbf884fcdfcca1
Link:
https://www.unpac.me/results/291f5866-5a4b-45c4-9ce2-3a4a22943bf4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ffead35df6bc101476d76393619fe0a06a57d93927417d9bcf814d2e4c6b36a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with ConfuserEx Mod
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe ffead35df6bc101476d76393619fe0a06a57d93927417d9bcf814d2e4c6b36a0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2444659/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2401222/
  
URLhaus
https://urlhaus.abuse.ch/url/2407601/
  
URLhaus
https://urlhaus.abuse.ch/url/2409762/
  
URLhaus
https://urlhaus.abuse.ch/url/2414327/

Comments