Edit tour
Windows
Analysis Report
OZq1f2sZz3.exe
Overview
General Information
Sample name: | OZq1f2sZz3.exerenamed because original name is a hash value |
Original sample name: | 209fbae1dc4dc78a2658fe4661208807.exe |
Analysis ID: | 1579892 |
MD5: | 209fbae1dc4dc78a2658fe4661208807 |
SHA1: | 7a8050672dcd6df8c45c658aba20d94d87f6c6b6 |
SHA256: | ba8ac250bdc6e0bd364bd98fd4404bdc32517eacdad84977133e87aac46af90e |
Tags: | AsyncRATexeRATuser-abuse_ch |
Infos: | |
Detection
AsyncRAT
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AsyncRAT
AI detected suspicious sample
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential time zone aware malware
Program does not show much activity (idle)
Queries disk information (often used to detect virtual machines)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Yara signature match
Classification
- System is w10x64
- OZq1f2sZz3.exe (PID: 7348 cmdline:
"C:\Users\ user\Deskt op\OZq1f2s Zz3.exe" MD5: 209FBAE1DC4DC78A2658FE4661208807) - conhost.exe (PID: 7356 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
AsyncRAT | AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques. | No Attribution |
{"Server": "104.236.39.42", "Port": "6606,7707,8808", "Version": "0.5.8", "MutexName": "NLzwJdZ9VJQw", "Autorun": "false", "Group": "null"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
Windows_Trojan_Donutloader_f40e3759 | unknown | unknown |
| |
Windows_Trojan_Donutloader_f40e3759 | unknown | unknown |
| |
JoeSecurity_AsyncRAT | Yara detected AsyncRAT | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
Windows_Trojan_Asyncrat_11a11ba1 | unknown | unknown |
| |
Click to see the 8 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_AsyncRAT | Yara detected AsyncRAT | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
Windows_Trojan_Asyncrat_11a11ba1 | unknown | unknown |
| |
INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse | Detects file containing reversed ASEP Autorun registry keys | ditekSHen |
| |
JoeSecurity_AsyncRAT | Yara detected AsyncRAT | Joe Security | ||
Click to see the 2 entries |
⊘No Sigma rule has matched
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-23T14:02:07.148452+0100 | 2035595 | 1 | Domain Observed Used for C2 Detected | 104.236.39.42 | 7707 | 192.168.2.6 | 49716 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-23T14:02:07.148452+0100 | 2035607 | 1 | Domain Observed Used for C2 Detected | 104.236.39.42 | 7707 | 192.168.2.6 | 49716 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-12-23T14:02:07.148452+0100 | 2842478 | 1 | Malware Command and Control Activity Detected | 104.236.39.42 | 7707 | 192.168.2.6 | 49716 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Malware Configuration Extractor: |
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Static PE information: |
Source: | Code function: | 1_2_00007FF71BCE3A08 |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | File source: | ||
Source: | File source: |
Source: | TCP traffic: |
Source: | ASN Name: |
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: | ||
Source: | TCP traffic detected without corresponding DNS query: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Key, Mouse, Clipboard, Microphone and Screen Capturing |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Operating System Destruction |
---|
Source: | Code function: | 1_2_00007FF71BC61A10 |
System Summary |
---|
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Code function: | 1_2_00007FF71BC61A10 |
Source: | Code function: | 1_2_00007FF71BCD7AF8 | |
Source: | Code function: | 1_2_00007FF71BCE9AAC | |
Source: | Code function: | 1_2_00007FF71BCE3A08 | |
Source: | Code function: | 1_2_00007FF71BCD993C | |
Source: | Code function: | 1_2_00007FF71BCE805C | |
Source: | Code function: | 1_2_00007FF71BCD9460 | |
Source: | Code function: | 1_2_00007FF71BCDD460 | |
Source: | Code function: | 1_2_00007FF71BCD78F4 | |
Source: | Code function: | 1_2_00007FF71BCD76F0 | |
Source: | Code function: | 1_2_00007FF71BCE55CC | |
Source: | Code function: | 1_2_00007FF71BCE6ADC | |
Source: | Code function: | 1_2_00007FF71BCE2988 | |
Source: | Code function: | 1_2_00007FF71BCE094C | |
Source: | Code function: | 1_2_00007FF71BCD7064 | |
Source: | Code function: | 1_2_00007FF71BCE0FCC | |
Source: | Code function: | 1_2_00007FF71BCDED84 | |
Source: | Code function: | 1_2_00007FF71BCE04B8 | |
Source: | Code function: | 1_2_00007FF71BCD8258 | |
Source: | Code function: | 1_2_00007FF71BCDC198 | |
Source: | Code function: | 1_2_00007FF71BCE21D4 | |
Source: | Code function: | 1_2_00007FF71BCDA120 | |
Source: | Code function: | 1_2_00007FF71BCD8778 | |
Source: | Code function: | 1_2_00007FF71BCDE67C | |
Source: | Code function: | 1_2_0000024BC1C7DFC5 | |
Source: | Code function: | 1_2_0000024BC1C7E395 | |
Source: | Code function: | 1_2_0000024BC1C81AC5 | |
Source: | Code function: | 1_2_0000024BC1C7E7CD | |
Source: | Code function: | 1_2_0000024BC1C7D0D1 | |
Source: | Code function: | 1_2_0000024BC1C7F26D | |
Source: | Code function: | 1_2_00007FFD34491ED1 | |
Source: | Code function: | 1_2_00007FFD34496E96 | |
Source: | Code function: | 1_2_00007FFD34497C42 | |
Source: | Code function: | 1_2_00007FFD344952F2 | |
Source: | Code function: | 1_2_00007FFD344922E3 | |
Source: | Code function: | 1_2_00007FFD344923A1 |
Source: | Code function: |
Source: | Binary or memory string: |
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: | ||
Source: | Matched rule: |
Source: | Base64 encoded string: |