MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 30 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5
SHA3-384 hash: 16d3dd83eaf26ff4d51ef339e238bbdbfbadc98384aa46047eed15fd57522cc149a9a6e93f8f24cfd96e5ce68fbb3227
SHA1 hash: 010f9441b0847d42463ee9b13a10aba09ee17244
MD5 hash: e419795d628673b955401d67ec1e551c
humanhash: kansas-green-sierra-illinois
File name:DOCUMENTO REQUERIMIENTO POR INCONSISTENCIA GENERAL EN LIBROS CONTABLES RADICADO2060603 REVISION ADMINISTRATIVApdf.js
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:346'862 bytes
First seen:2026-06-03 19:47:55 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 1536:3nwFcftxWJaa4gXynMd2Y4x9V86gL/Na59UVW2C2XKCbi8MEBVzwopDdAThp9UMT:3b
Threatray 112 similar samples on MalwareBazaar
TLSH T19174275303851BBDF69D0EC9C94B215B20F2D8677D251298EBB36EE7BC3B9849430636
Magika javascript
Reporter Anonymous
Tags:AsyncRAT js

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.31320.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a20851df8676ad4d360cd23
Tags:
asyncrat shell sage remo
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
encrypted obfuscated repaired
Link:
https://www.filescan.io/uploads/6a20850a46e44aecc0cd6fc7/reports/115df4cb-c510-47f9-8e08-e5fc519b09c5/overview
Verdict:
Malicious
Labled as:
JS/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5
Verdict:
Clean
File Type:
js
Link:
https://opentip.kaspersky.com/09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5
Gathering data
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5/
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5
Threat name:
Win32.Trojan.Kepavll
Create hunting rule
Status:
Malicious
First seen:
2026-06-03 19:46:55 UTC
File Type:
Text (JavaScript)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bgtxrrdhxjf6x7chp6fkxce2uh5v5hsclczuoednz3ci7eptfxcq._file
Verdict:
malicious
Label(s):
purecrypter
Create hunting rule
asyncrat
Create hunting rule
Similar samples:
1742b48fad9814441ee7726009a0e375757134dcc872f88ed584b6a2099c7473
AsyncRAT
88f4284bc8f0f23ab3b6c37b3c1ae3f04993af17c2b968900006960338898546
AsyncRAT
8e1f62b87234e54baf7ca40bfd2a81a6ed53b5a009b15ce7e4cba7d54d39a3a2
AsyncRAT
97ebd98d982c5cd240180005962d3cc4622d0503e8086935400312702a16cf9f
AsyncRAT
a9b516990db5fb757d5745cbca218fb6996562af0454dc3820403890d77abcb6
AsyncRAT
c417f420eac28ba0ab916974e8d82630d9392882f1fd45593c8872f979d18e7a
AsyncRAT
e1c27a877bbea8863536c2ba291991c1dd033c88a4eb7da9465e3e2224ba6177
AsyncRAT
error
AsyncRAT
f622737668c513f985371efab074a144515a44e2f38216d46a60fa17e190f301
AsyncRAT
+ 102 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default defense_evasion discovery execution rat spyware stealer suricata
Link:
https://tria.ge/reports/260603-yjczjad181/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Reads user/profile data of web browsers
Family: AsyncRat
Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
Malware Config
C2 Extraction:
loganwolverin2040.duckdns.org:6090
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/09a778c467ba4bebfc477f8aab889aa1fb5e9e4258b347106dcec48f91f32dc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:AsyncRAT_057B
Create hunting rule
Author:kirkderp
Description:AsyncRAT 0.5.7B -- minimal .NET RAT with PBKDF2 key derivation and MessagePack serialization
Reference:https://github.com/kirkderp/yara
Rule name:asyncrat_kingrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:malware_asyncrat
Create hunting rule
Description:detect AsyncRat in memory
Reference:https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp
Rule name:MAL_AsnycRAT
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:MAL_AsyncRAT_Config_Decryption
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:Mal_WIN_AsyncRat_RAT_PE
Create hunting rule
Author:Phatcharadol Thangplub
Description:Use to detect AsyncRAT implant.
Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io
Rule name:SUSP_Reverse_Run_Key
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a Reversed Run Key
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Generic_Threat_ce98c4bc
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Asyncrat_11a11ba1
Create hunting rule
Author:Elastic Security
Rule name:win_asyncrat_bytecodes
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects bytecodes present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_unobfuscated
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments