MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1
SHA3-384 hash: 19186b55b5cd25b0f2474b41cf126d710f628067a12d983be3e496e46dd883762467f369537e6924134d40c422ca04e0
SHA1 hash: ae571089bd1a730338d072115fd05353d3d91ed6
MD5 hash: 2dd19c1ab7885a0c89206917adc6f03d
humanhash: nuts-solar-nineteen-green
File name:Shipping Detailst.vbs
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:2'551'774 bytes
First seen:2026-08-20 07:37:11 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 768:eoP5YTdCk1sFm/jlD7jBB6+/CNcgc16+CSqqB/+KcqCpi7JvvqvWVdvvaN2JIl3Y:y9
TLSH T1B0C57D606F3B8975DE24FEAB617046E01BC9830A1497CB805CC6DE5B4EE5BB099BDC1C
TrID 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1)
33.3% (.MP3) MP3 audio (1000/1)
Magika autoit
Reporter abuse_ch
Tags:AsyncRAT RAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/82155/
Detection(s):
SecuriteInfo.com.VBS.Generic.280.10323.5211.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
downloader masquerade
Link:
https://www.filescan.io/uploads/6a86aebb679c8879d18a131b/reports/010fa98b-c91a-4712-9fed-ddb5ff91b763/overview
Verdict:
Malicious
Labled as:
PowerShell/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1960954
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Command shell drops VBS files
Connects to a pastebin service (likely for C&C)
Contains functionality to check if Internet connection is working
Creates an undocumented autostart registry key
Creates processes via WMI
Detected large data written to user environment variables, potentially indicating payload staging for fileless execution
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain checking for user administrative privileges
Found malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Suspicious Environment Variable Has Been Registered
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows Shell Script Host drops VBS files
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1960954 Sample: Shipping Detailst.vbs Startdate: 20/08/2026 Architecture: WINDOWS Score: 100 79 pastebin.com 2->79 81 halakw.com 2->81 97 Suricata IDS alerts for network traffic 2->97 99 Found malware configuration 2->99 101 Malicious sample detected (through community Yara rule) 2->101 105 18 other signatures 2->105 11 wscript.exe 3 3 2->11         started        15 diskdiag.exe 2->15         started        17 wscript.exe 2->17         started        19 2 other processes 2->19 signatures3 103 Connects to a pastebin service (likely for C&C) 79->103 process4 file5 71 C:\Users\Public\Downloads\dFVGaCvthu.vbs, Unicode 11->71 dropped 131 Suspicious powershell command line found 11->131 133 Wscript starts Powershell (via cmd or directly) 11->133 135 Windows Shell Script Host drops VBS files 11->135 137 6 other signatures 11->137 21 powershell.exe 14 8 11->21         started        25 powershell.exe 7 11->25         started        27 diskdiag.exe 15->27         started        signatures6 process7 dnsIp8 83 94.26.3.15, 49731, 80 MILLENIALHOSTLIMITED-AS-GBMillenialHostLimitedHK United States 21->83 113 Writes to foreign memory regions 21->113 115 Found suspicious powershell code related to unpacking or dynamic code loading 21->115 117 Injects a PE file into a foreign processes 21->117 29 CasPol.exe 15 7 21->29         started        34 cmd.exe 2 21->34         started        36 conhost.exe 21->36         started        38 conhost.exe 25->38         started        85 139.99.88.62, 3778, 49740 OVHFR Singapore 27->85 87 pastebin.com 104.20.29.150, 443, 49739 CLOUDFLARENET-CloudflareIncUS Canada 27->87 119 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 27->119 40 schtasks.exe 27->40         started        signatures9 process10 dnsIp11 89 halakw.com 217.217.97.59, 49732, 7004 WINDSTREAM-WindstreamCommunicationsLLCUS China 29->89 91 45.141.27.27, 49733, 80 CLOUDFORESTCOLTD-AS-APCLOUDFORESTCOLTDTH Thailand 29->91 93 85.203.4.64, 49738, 80 CLOUDFORESTCOLTD-AS-APCLOUDFORESTCOLTDTH Thailand 29->93 73 C:\Users\...\ualtgnSecurityHealthService.exe, PE32 29->73 dropped 75 C:\Users\user\AppData\...\ffpeunclient.exe, PE32+ 29->75 dropped 145 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 29->145 42 ffpeunclient.exe 29->42         started        46 ualtgnSecurityHealthService.exe 9 29->46         started        77 C:\Users\Public\Libraries\dFVGaCvthu.vbs, ASCII 34->77 dropped 147 Command shell drops VBS files 34->147 48 conhost.exe 34->48         started        50 conhost.exe 40->50         started        file12 signatures13 process14 file15 67 C:\Users\user\AppData\Local\...\diskdiag.exe, PE32+ 42->67 dropped 121 Multi AV Scanner detection for dropped file 42->121 123 Found evasive API chain (may stop execution after checking mutex) 42->123 125 Creates an undocumented autostart registry key 42->125 129 2 other signatures 42->129 52 diskdiag.exe 42->52         started        55 schtasks.exe 42->55         started        69 C:\Users\user\...\SecurtyHeathService.exe, PE32+ 46->69 dropped 127 Antivirus detection for dropped file 46->127 57 cmd.exe 1 46->57         started        signatures16 process17 signatures18 107 Multi AV Scanner detection for dropped file 52->107 109 Found evasive API chain (may stop execution after checking mutex) 52->109 111 Found evasive API chain checking for user administrative privileges 52->111 59 conhost.exe 55->59         started        61 SecurtyHeathService.exe 1 57->61         started        65 conhost.exe 57->65         started        process19 dnsIp20 95 82.26.104.192, 31104, 49736 DE-CORPDE-CORPTH Thailand 61->95 139 Antivirus detection for dropped file 61->139 141 Multi AV Scanner detection for dropped file 61->141 143 Contains functionality to check if Internet connection is working 61->143 signatures21
Verdict:
Malware
YARA:
2 match(es)
Tags:
DeObfuscated PowerShell T1027 T1059.001
Link:
https://app.malva.re/file/2dd19c1ab7885a0c89206917adc6f03d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=apm3sz22tbmd5slllh7mmmczmqpdedf4q52n4lp2onvla3gqbcyq._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/05cf7f34-b0e9-4a61-9d69-a63c765d7501
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection defense_evasion discovery execution persistence privilege_escalation rat trojan upx
Link:
https://tria.ge/reports/260820-jf5g2ssclb/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook profiles
Contacts third-party web service commonly abused for C2
Checks computer location settings
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Modifies Windows Firewall
Detect Xworm Payload
Family: Xworm
Process spawned unexpected child process
Malware Config
C2 Extraction:
halakw.com:7004
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
Link:
https://yomi.yoroi.company/submissions/03d9b9675a98583ec96b59fec63059641e320cbc8774de2dfa736ab06cd008b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:rat_win_xworm_v3
Create hunting rule
Author:Sekoia.io
Description:Finds XWorm (version XClient, v3) samples based on characteristic strings
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/82155/

Comments