MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb
SHA3-384 hash: 25107b45bb7809a72dd2ab1d379be0db75df39e635eb9709281e471f228043970019d6f5bf01a7747675a57e6c149909
SHA1 hash: a68c9126e152f21117e96aee219328468e71168c
MD5 hash: 1e42c63993892a80dacf0556d1ece0a7
humanhash: bravo-xray-delaware-delta
File name:SecuriteInfo.com.Win32.Evo-gen.17588.32715
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:3'795'968 bytes
First seen:2025-05-31 08:38:02 UTC
Last seen:2025-05-31 10:20:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4328f7206db519cd4e82283211d98e83 (533 x RedLineStealer, 18 x Arechclient2, 15 x DCRat)
ssdeep 49152:3BKyXWGcnSlC4tokgWOBy50qNcH6W7SIPKUyuX4FaPgZPcvr/RtHPkMtzQvfQuWy:0ymGc1y0rpqcaTyyNWqYDcMAQuWk2VU
Threatray 5 similar samples on MalwareBazaar
TLSH T1050633B426C1F1CFC74BC6B5F518A8E10EB1AD5D80B4CC4C39AD36692373BBA4629D49
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon 9288ce8c2a868f92 (89 x Tinba, 7 x AsyncRAT, 6 x Dridex)
Reporter SecuriteInfoCom
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
543
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
499566a266167eafe01198dc8b92d73c7acd19c4a0a99707c2b5e67291ff4076.ps1
Verdict:
Malicious activity
Analysis date:
2025-05-31 05:37:57 UTC
Tags:
loader java telegram auto-reg auto-startup remote xworm themida crypto-regex ims-api generic
Link:
https://app.any.run/tasks/17d1c770-c721-4092-b1dc-e6b52a09a887

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/6509/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.17588.32715.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=683ac0dc668438e362e8e4a7
Tags:
vmdetect autorun
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for analyzing tools
Сreating synchronization primitives
Creating a process with a hidden window
Creating a window
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed packer_detected themidawinlicense
Link:
https://www.filescan.io/uploads/683ac007171e01f959324187/reports/1dec9a03-3866-4df1-b449-eb3b9d8f1728/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2f24d2ba-4aa4-4402-a9b9-f6602750a839
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1702878
Signature
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Protects its processes via BreakOnTermination flag
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses dynamic DNS services
Uses the Telegram API (likely for C&C communication)
Yara detected Telegram RAT
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1702878 Sample: SecuriteInfo.com.Win32.Evo-... Startdate: 31/05/2025 Architecture: WINDOWS Score: 100 31 rcglobo.duckdns.org 2->31 33 api.telegram.org 2->33 39 Suricata IDS alerts for network traffic 2->39 41 Found malware configuration 2->41 43 Malicious sample detected (through community Yara rule) 2->43 49 8 other signatures 2->49 8 SecuriteInfo.com.Win32.Evo-gen.17588.32715.exe 16 5 2->8         started        12 conhost.exe 2->12         started        signatures3 45 Uses dynamic DNS services 31->45 47 Uses the Telegram API (likely for C&C communication) 33->47 process4 dnsIp5 35 rcglobo.duckdns.org 176.65.141.36, 49723, 56001 WEBTRAFFICDE Germany 8->35 37 api.telegram.org 149.154.167.220, 443, 49722 TELEGRAMRU United Kingdom 8->37 51 Detected unpacking (changes PE section rights) 8->51 53 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->53 55 Query firmware table information (likely to detect VMs) 8->55 57 7 other signatures 8->57 14 powershell.exe 23 8->14         started        17 powershell.exe 23 8->17         started        19 powershell.exe 23 8->19         started        21 powershell.exe 22 8->21         started        signatures6 process7 signatures8 59 Loading BitLocker PowerShell Module 14->59 23 conhost.exe 14->23         started        25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        process9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb/
Threat name:
Win32.Trojan.XWormRAT
Create hunting rule
Status:
Malicious
First seen:
2025-05-31 08:38:34 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=abf2sabaw5vak5ulacr5wibgpbd4b4n76xd4ybwyip2rjthexpnq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb
AsyncRAT
12ec8012b34cf052973a6661849c1c3f390eaab20b427a4c60ed18a3fa8cc56c
AsyncRAT
374ba36753d3cc17ed6a2d49087519eb0f7a0095f741eeb2a7ab7aa9c1246553
AsyncRAT
7df7d998a4613f1faf81abcea746fe8f3f49c3857ea6898621a5b435ff1aa354
AsyncRAT
error
AsyncRAT
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion discovery execution persistence themida trojan
Link:
https://tria.ge/reports/250531-kjw6hsdl9x/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Drops startup file
Themida packer
Command and Scripting Interpreter: PowerShell
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/49328153-6272-4be5-bd0d-ddd8b8ad0350
Unpacked files
SH256 hash:
004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb
MD5 hash:
1e42c63993892a80dacf0556d1ece0a7
SHA1 hash:
a68c9126e152f21117e96aee219328468e71168c
Link:
https://www.unpac.me/results/31d78f75-d266-4399-89a4-89a2ec4ad648/
SH256 hash:
de0aa79373299d38e79f5895530c54d43970c18867212ee171580e5e28dca5eb
MD5 hash:
8c7fb0e684cd7873d2641f301c2d41dd
SHA1 hash:
0a65293bd4af0d865c4d7dabacd49ca978cc063b
Link:
https://www.unpac.me/results/31d78f75-d266-4399-89a4-89a2ec4ad648/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/004ba90020b7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.74
Link:
https://yomi.yoroi.company/submissions/004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:win_xworm_bytestring
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects bytestring present in unobfuscated xworm
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe 004ba90020b76a05768b00a3db20267847c0f1bff5c7cc06d843f514cce4bbdb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3555785/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/6509/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments