24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AsyncRAT.Marte.B.Generic Sample 6dcbbe9f8d40… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6dcbbe9f8d40…. Malware family: AsyncRAT.Marte.B.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4","keywords":["Malicious","AsyncRAT.Marte.B.Generic","malware analysis","sandbox report","threat intelligence","6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4"],"about":{"@type":"SoftwareApplication","name":"wethhist.org_3ff9062b_zoom-updater.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"AsyncRAT.Marte.B.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9d0,Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "Aes256" (Indicator: "Aes"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "6dcbbe9f8d4072b99884ceb48e69a6fef1d3cb8fffacebbfab602093dcb987d4.bin")26:T4ca,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to perform crypto operations Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains symmetric decryption functionality in .NET code27:T15bd,"