🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 096451c8d271c5c5768462a9273ca336cba6396b8a3fa0add9d57147cb809511. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 096451c8d271c5c5768462a9273ca336cba6396b8a3fa0add9d57147cb809511
SHA3-384 hash: 8fbfef2c976dfd0438f9b29f085dac3d4443c5ea17c430ae8f2f5bdc239aab97704d236c075a7997e3f632ff2370544c
SHA1 hash: 816ea736e8a59e70d793cfe66a49e2af80ff7c88
MD5 hash: aaed87c1b916e414c2b88ab2135f3d57
humanhash: grey-quiet-may-william
File name:hooks.mins.js
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:2'247'830 bytes
First seen:2025-08-19 14:40:41 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:6Lb7PEg3rggp8RXVKldtwME8aXjojKEAAMxWDxezuuBom5yFr1WArDn6WdG+N8Qc:m0jR0rgoA+jfhMDbdQwpU1czZtTXPf
Threatray 843 similar samples on MalwareBazaar
TLSH T194A56A1DBBEC22EA9DCF1887D27E916CA3F69782C54621CF92E37012704EF1A5525C93
Magika javascript
Reporter abuse_ch
Tags:AsyncRAT js

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
SE SE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a48d2bc2f5296a1a284d74
Tags:
vmdetect autorun neshta
Verdict:
Malicious
Labled as:
GT:JS.Divergent.3
Link:
https://www.hybrid-analysis.com/sample/096451c8d271c5c5768462a9273ca336cba6396b8a3fa0add9d57147cb809511
Result
Threat name:
WSHRat, AsyncRAT, Neshta
Create hunting rule
Detection:
malicious
Classification:
spre.troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1760311
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Detected WSHRat
Drops script or batch files to the startup folder
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: HackTool - CACTUSTORCH Remote Thread Creation
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Register Wscript In Run Key
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected Neshta
Yara detected WSHRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1760311 Sample: hooks.mins.js Startdate: 19/08/2025 Architecture: WINDOWS Score: 100 91 offer5302025.mooo.com 2->91 93 umar33myddns.rocks 2->93 95 9 other IPs or domains 2->95 117 Sigma detected: Register Wscript In Run Key 2->117 119 Suricata IDS alerts for network traffic 2->119 121 Found malware configuration 2->121 123 20 other signatures 2->123 15 wscript.exe 4 3 2->15         started        19 Windows Audio.exe 2->19         started        21 Windows Audio.exe 2->21         started        23 3 other processes 2->23 signatures3 process4 file5 87 C:\Users\user\AppData\Local\Temp\svchost.js, ASCII 15->87 dropped 103 Benign windows process drops PE files 15->103 105 Detected WSHRat 15->105 107 JScript performs obfuscated calls to suspicious functions 15->107 115 3 other signatures 15->115 25 wscript.exe 2 15->25         started        28 wscript.exe 3 3 15->28         started        109 Injects a PE file into a foreign processes 19->109 30 Windows Audio.exe 19->30         started        33 Windows Audio.exe 21->33         started        111 System process connects to network (likely due to code injection or exploit) 23->111 113 Wscript called in batch mode (surpress errors) 23->113 35 wscript.exe 23->35         started        signatures6 process7 dnsIp8 83 C:\Users\user\AppData\Local\Temp\Wrl.exe, PE32 25->83 dropped 37 Wrl.exe 4 25->37         started        41 wscript.exe 1 3 28->41         started        43 EXCEL.EXE 116 61 28->43         started        99 chongmei33.publicvm.com 178.73.192.5, 2703, 49713 PORTLANEwwwportlanecomSE Sweden 30->99 101 umar33myddns.rocks 34.41.139.193, 49710, 5670 ATGS-MMD-ASUS United States 30->101 file9 process10 dnsIp11 75 C:\Users\user\AppData\Local\Temp\...\Wrl.exe, PE32 37->75 dropped 127 Antivirus detection for dropped file 37->127 46 Wrl.exe 37->46         started        77 C:\Users\user\AppData\Roaming\...\Filname.js, ASCII 41->77 dropped 79 C:\Users\user\AppData\Roaming\Filname.js, ASCII 41->79 dropped 129 Creates multiple autostart registry keys 41->129 131 Windows Scripting host queries suspicious COM object (likely to drop second stage) 41->131 133 Wscript called in batch mode (surpress errors) 41->133 49 wscript.exe 41->49         started        97 s-part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49726, 49729 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 43->97 52 splwow64.exe 43->52         started        file12 signatures13 process14 dnsIp15 137 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 46->137 139 Injects a PE file into a foreign processes 46->139 54 Wrl.exe 46->54         started        89 offer5302025.mooo.com 127.0.0.2 unknown unknown 49->89 signatures16 process17 file18 81 C:\Users\user\AppData\...\Windows Audio.exe, PE32 54->81 dropped 135 Creates multiple autostart registry keys 54->135 58 cmd.exe 54->58         started        signatures19 process20 process21 60 Windows Audio.exe 58->60         started        63 timeout.exe 58->63         started        66 conhost.exe 58->66         started        file22 85 C:\Users\user\AppData\...\Windows Audio.exe, PE32 60->85 dropped 68 Windows Audio.exe 60->68         started        141 Wscript called in batch mode (surpress errors) 63->141 signatures23 process24 signatures25 125 Injects a PE file into a foreign processes 68->125 71 Windows Audio.exe 68->71         started        process26 process27 73 cmd.exe 71->73         started       
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/096451c8d271c5c5768462a9273ca336cba6396b8a3fa0add9d57147cb809511
Verdict:
inconclusive
YARA:
1 match(es)
Link:
https://app.malva.re/file/aaed87c1b916e414c2b88ab2135f3d57
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/096451c8d271c5c5768462a9273ca336cba6396b8a3fa0add9d57147cb809511/
Verdict:
Malicious
Threat:
Family.NESHTA
Link:
https://tip.neiki.dev/file/096451c8d271c5c5768462a9273ca336cba6396b8a3fa0add9d57147cb809511
Threat name:
Script-JS.Trojan.Divergent
Create hunting rule
Status:
Malicious
First seen:
2025-08-19 08:42:41 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bfsfdsgsohc4k5uemkusopfdg3f2mollri72bloz2vyups4asuiq._file
Verdict:
malicious
Label(s):
neshta
Create hunting rule
Similar samples:
0eee8ec8c4cca1e93ce4ddba4672e9ed733d6987da7b1de7f5facaa2528024dc
AsyncRAT
10d8f2dcaf45c565724f4ff3aecaeef06852e3fd7754ffebf0c3695013549969
AsyncRAT
2744c04eaed1afa8fe7883ef8204dafb8d7ae3bb0231d11bf3e1a93a93193a7f
AsyncRAT
3293e5eccf40a40cf173761c6b9f8ae39d66934be58635c9e19e4c93ef0cd159
AsyncRAT
5e83e806d8d6e215b96ee2a26627cfee517debc410e2654fc956d762cf96d58a
AsyncRAT
74740b8bb9bf19c9dcdfb550421cc7d950654d5a447f512c7d1327999e31f0d0
AsyncRAT
de0a2dcaa49ec8c9d12289e7eb13b4a3bbf958050ad2aeb42f1dbfab9a1f255d
AsyncRAT
ee3d3e0d8a196911117148b3cc2fc93ed6ae1e3afbdc3031e4ffa727a98ff83d
AsyncRAT
error
AsyncRAT
+ 833 additional samples on MalwareBazaar
Result
Malware family:
neshta
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:neshta botnet:default-aug 25-16 defense_evasion discovery execution persistence rat spyware stealer
Link:
https://tria.ge/reports/250819-r6x5navvg1/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Modifies system executable filetype association
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Modifies trusted root certificate store through registry
AsyncRat
Asyncrat family
Detect Neshta payload
Neshta
Neshta family
Malware Config
C2 Extraction:
jamesrockky.ydns.eu:2703
jamesrockky.ydns.eu:5670
chongmei33.publicvm.com:2703
chongmei33.publicvm.com:5670
umar33myddns.rocks:2703
umar33myddns.rocks:5670
zoo33.myddns.rocks:2703
zoo33.myddns.rocks:5670
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/096451c8d271/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:SUSP_Double_Base64_Encoded_Executable_RID34CC
Create hunting rule
Author:Florian Roth
Description:Detects an executable that has been encoded with base64 twice
Reference:https://twitter.com/TweeterCyber/status/1189073238803877889
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Java Script (JS) js 096451c8d271c5c5768462a9273ca336cba6396b8a3fa0add9d57147cb809511

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3606579/
  
Delivery method
Distributed via web download

Comments