MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 5 File information Comments

SHA256 hash:	053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db
SHA3-384 hash:	e3afe3c6f54820faae389aab532f2715981d4eca29b0b2c913d97964b2a79d152cb8fdd964a49e5a97956359c3431a19
SHA1 hash:	5fb5049a3266c03b2de10139e2f2bb69cfe9f58d
MD5 hash:	50dd6a9d7d6e9737f1f4299f040cc897
humanhash:	rugby-william-shade-magnesium
File name:	rswvafhj.asm.dll
Download:	download sample
File size:	11'264 bytes
First seen:	2026-11-06 09:06:26 UTC
Last seen:	2026-11-06 09:43:06 UTC
File type:	dll
MIME type:	application/vnd.microsoft.portable-executable
imphash	dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep	192:FjxjB8AVxwPS+qKnEUEAvSXQQMQg2ZKdgkijfBrRw4Za9QeZ7pzqvDa:FFj+AVxT0REAvSXQ/zgksRrdgBqvDa
TLSH	T17532B6176BDDAAA3E47E473978B312A5D770F522029BDB3348C4317C6A507E02B993E0
TrID	21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 21.2% (.EXE) Win64 Executable (generic) (6522/11/2) 16.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 14.6% (.EXE) Win32 Executable (generic) (4504/4/1) 6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	xor
Tags:	AsyncRAT dll Utils

Intelligence

File Origin

# of uploads :

# of downloads :

198

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/97590/

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aed98c20e723c88a40c890a

Tags:

virus msil

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6aed98bdb0725dd71bbc3466/reports/b8555ac6-7cfd-496c-882d-ca94b078c6c0/overview

Verdict:

Malicious

Labled as:

MSILHeracles.Generic

Link:

https://www.hybrid-analysis.com/sample/053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db

Verdict:

Malicious

File Type:

executable.pe.32.dll

Link:

https://opentip.kaspersky.com/053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1af1b993-36ca-4802-9534-6c7613aab214

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1999619

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.32 Win 32 Exe x86

Link:

https://app.malva.re/file/50dd6a9d7d6e9737f1f4299f040cc897

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db/

Threat name:

Win32.Trojan.MsilHrcls

Status:

Malicious

First seen:

2026-11-05 12:41:30 UTC

File Type:

PE (.Net Dll)

AV detection:

25 of 38 (65.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=au734szcxl4betr4jixikruyxcolgw5z5uvejcsvv6r2tub7itnq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261106-k3d42sbx8n/

Malware Family:

msilheracles

Malicious:

True

Tags:

pedll payload dotnet

Link:

https://intel.virussign.com/intelligence/file/053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db

Unpacked files

SH256 hash:

053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db

MD5 hash:

50dd6a9d7d6e9737f1f4299f040cc897

SHA1 hash:

5fb5049a3266c03b2de10139e2f2bb69cfe9f58d

Link:

https://www.unpac.me/results/3f1624b8-7895-4fe8-8052-a203724cad75/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/053fbe4b22baf8124e3c4a2e854698b89cb35bb9ed2a448a55afa3a9d03f44db

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	extracted_at_0x44b Create hunting rule
Author:	cb
Description:	sample - file extracted_at_0x44b.exe
Reference:	Internal Research

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.