26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.AsyncRAT Sample 53a8bd56d87f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 53a8bd56d87f…. Malware family: IL:Trojan.AsyncRAT. Threat score 100/100. 18/27 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5","keywords":["Malicious","IL:Trojan.AsyncRAT","malware analysis","sandbox report","threat intelligence","53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5"],"about":{"@type":"SoftwareApplication","name":"53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5","applicationCategory":["peexe","assembly","executable"],"identifier":"53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.AsyncRAT","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T932,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "CreateDecryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "SendSync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "shutdown.exe /f /s /t 0" (Indicator: "shutdown"; Source: "sample.bin"), Found reference to API "WaitForExit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "m_ThreadStaticValue" (Indicator: "read"; Source: "sample.bin"), Found reference to API "m_ThreadStaticValue" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "DelegateAsyncResult" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CloseMutex" (Indicator: "close"; Source: "sample.bin"), Found reference to API "Socket" (Indicator: "socket"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), Found reference to API "CreateMutex" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "isDisconnected" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "SecurityProtocolType" (Indicator: "security"; Source: "sample.bin"), Found reference to API "AsyncCallback" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Open [" (Indicator: "open"; Source: "sample.bin"), Found reference to API "Create__Instance__" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateSubKey" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "NewLateBinding" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "GetRandomString" (Indicator: "getrandom"; Source: "sample.bin"), Found reference to API "ThreadStart" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Spread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadInt32" (Indicator: "read"; Source: "sample.bin")28:T747,Found reference to API (Indicator: "CreateMutex"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKey"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "ToUnicodeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CompareString"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardState"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardLayout"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileName"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastInputInfo"; Source: "sample.bin")29:T482,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "sample.bin"), Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "sample.bin"), Found string "GZipStream" (Indicator: "GzipStream"; Source: "sample.bin"), Found string "AlgorithmAES" (Indicator: "aes"; Source: "sample.bin"), Found string "AES_Encryptor" (Indicator: "aes"; Source: "sample.bin"), Found string "AES_Decryptor" (Indicator: "aes"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin")2a:T4d1,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "53a8bd56d87f50e7cef6a9ffa7edbe1e3ed611457b6c7fd577a6a0ffb0f1d2d5.bin"2b:T452,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: YARA signature match - AES encryption2c:T775,"