MALICIOUS — cfd7fdc9447d994abd14313bcd934d5a1bf9c1f8cef57a0e7887c9db48a26ee0

MALICIOUS — cfd7fdc9447d994abd14313bcd934d5a1bf9c1f8cef57a0e7887c9db48a26ee0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AsyncRAT family. 8 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: cfd7fdc9447d994abd14313bcd934d5a1bf9c1f8cef57a0e7887c9db48a26ee0
SHA-1: acdbc6c5db8040b0384f976cebb3036c63349424
MD5: 89778fac276ad8fa141dd652660d8440
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 3072:Kj5R5s6Fmrw8bw4gSnaxkWdDzXqIPu/i9bOO2cq6+WpDheMGnWBHY5msuh3UJQz:Umrw8E4gqanDbXPSi9bpMRQYu+JQ
TLSH: T1E74626CED2091A01CCE47ED0E137836DB1B2DCC6E0A36B59CACB55BD5CD58B78825226
Submitted as: cfd7fdc9447d994abd14313bcd934d5a1bf9c1f8cef57a0e7887c9db48a26ee0
File type: pe · Size: 291840 bytes
Verdict: malicious (100/100) · Family: AsyncRAT

Detections (8 of 56 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Packed.AsyncRAT-9856570-1
YARA: InQuest Labs: AgentTesla
YARA: PhishingKit (t4d): PK_Credential_Exfil_Telegram
YARA: MalwareAnalyser community pack: TL_Ransomware_Note_Markers
Microsoft Defender: Backdoor:MSIL/AsyncRat!atmn
Emsisoft (Emergency Kit): Gen:Variant.BigHead.20
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Packed.AsyncRAT-9856570-1 (rule Win.Packed.AsyncRAT-9856570-1) - engine signal, weight 0.90, confidence 0.95
YARA: InQuest Labs flagged AgentTesla (rule AgentTesla) - engine signal, weight 0.70, confidence 0.70
YARA: PhishingKit (t4d) flagged PK_Credential_Exfil_Telegram (rule PK_Credential_Exfil_Telegram) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Backdoor:MSIL/AsyncRat!atmn (rule Backdoor:MSIL/AsyncRat!atmn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.BigHead.20 (rule Gen:Variant.BigHead.20) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Stealer.gen (rule HEUR:Trojan-PSW.MSIL.Stealer.gen) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
YARA: MalwareAnalyser community pack flagged TL_Ransomware_Note_Markers (rule TL_Ransomware_Note_Markers) - engine signal, weight 0.50, confidence 0.70
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Extracted WorldWind config (0 C2) - engine signal, weight 0.45, confidence 0.60
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: https://api.telegram.org/bot - static signal, weight 0.35, confidence 0.60
encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 6076) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1750 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

f6a94457a9ee2486b8dfed56f149ea6408d7ecbdd650eb5b6ae03234ccbd4135 - f6a94457a9ee2486b8dfed56f149ea6408d7ecbdd650eb5b6ae03234ccbd4135

Embedded URLs

https://api.telegram.org/bot
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

github.com
api.telegram.org

Embedded IP addresses

20.184.175.1
20.42.179.204
4.144.132.223
4.230.171.124
4.150.223.113
135.234.160.246
52.110.12.33
52.110.12.18

File paths

C:\Users\Eric\Desktop\Site

More AsyncRAT samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report