MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43
SHA3-384 hash: 6e913410fe240bfebdae268f9620232c549ed44c08c2aae0cc9aaa97e6b9064fcec6df6c162bc7b5515860b5e6c1d6c2
SHA1 hash: 1fcf29399589a9186e800b49cba5f647299d611d
MD5 hash: 34710eb59126a97f820f5e8e6b87cc2f
humanhash: king-nuts-lamp-oregon
File name:0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:563'712 bytes
First seen:2025-08-12 14:56:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:PNavaMWSO4EJ8wTqpI2bOFVSdoxLMqSFU60:2OX6dvOFV4YLMqS
Threatray 444 similar samples on MalwareBazaar
TLSH T15AC4E0546798C501DABA5BB52834E2740375BE8AB421E70E9FC8BCEF3D727808D46763
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
_0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43.exe
Verdict:
Malicious activity
Analysis date:
2025-08-12 19:42:33 UTC
Tags:
auto-reg auto-sch-xml asyncrat
Link:
https://app.any.run/tasks/5fbf105c-11d5-4344-b65a-0a74107d9101

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/20877/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=689b5a85fca70bd90e8f1f24
Tags:
autorun shell sage msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a process with a hidden window
Creating a file in the %temp% directory
Launching a process
Restart of the analyzed sample
Creating a file
Running batch commands
Creating a process from a recently created file
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6d8633f4-0673-4c6f-9392-3b543688c8e6
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43
Gathering data
Gathering data
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2025-07-31 03:43:57 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=brc5xwxrogvrd5kee3td4gt6rmvxkm6i34jtqj2fzntug2gm5jbq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
unc_loader_037
Create hunting rule
Similar samples:
48feedffa17ca579fd3ddfaae4cec3c5c15f72b7b635d34d10d3e91af5e6d488
AsyncRAT
717343b73e45e00fbad3040f385b36005435c0d9b6e0cd6ef78b0f4bd4cf2907
AsyncRAT
9e621a704ce21860890b4fb94903908f66a6926e8cfc85a32615b241da33fd7d
AsyncRAT
b8b4021394c9823ce105f92ac6ec4b6aed630606add64945b9b3f8f73d561316
AsyncRAT
+ 434 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default defense_evasion discovery execution persistence rat
Link:
https://tria.ge/reports/250812-vksvlatsas/
Behaviour
Delays execution with timeout.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
AsyncRat
Asyncrat family
Malware Config
C2 Extraction:
127.0.0.1:19803
196.251.88.252:19803
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7e3c524e-9e22-4428-9cd5-d9d17c5509bf
Unpacked files
SH256 hash:
0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43
MD5 hash:
34710eb59126a97f820f5e8e6b87cc2f
SHA1 hash:
1fcf29399589a9186e800b49cba5f647299d611d
Link:
https://www.unpac.me/results/79467823-c2a9-44ad-b83f-289504ebb725/
SH256 hash:
502b0f495556c8e5bd27518cdcf49c5569306941ea58688a1dfdfeeb910ebec9
MD5 hash:
0a49af0d6b22feb8aeb42d1b45c2c0a2
SHA1 hash:
0fa2857c107407d17c8255e499ec3992c5de9c80
Link:
https://www.unpac.me/results/79467823-c2a9-44ad-b83f-289504ebb725/
SH256 hash:
f68d8d8881493aef1641ea5dd67584be6f33a871fa81019c420d442a2f7ab41d
MD5 hash:
c26466e32db0ba9330ed1aa9f0008d87
SHA1 hash:
f0d17f5320289675d06b6306b371327aeae5fd9d
Detections:
win_asyncrat_w0
Create hunting rule
AsyncRAT
Create hunting rule
asyncrat
Create hunting rule
win_asyncrat_bytecodes
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Link:
https://www.unpac.me/results/79467823-c2a9-44ad-b83f-289504ebb725/
Parent samples :
63a03d1998b2024f980c66873113d4cbd74262cfb1b4c0768246e38928db4b64
ecc76e448179411f5da32df012b94265f90dcb76366dff2a728a34405a0a2ba6
ba656c76c7366c1aab95e735327f076b9cef77c442c2598fe2182c5eeb61eb36
cd91908e6f1f320c216738d3357f949741d35b2c2b23fa84fbe482d4be842cb1
47f70c5d74fb0c00ee39f86290744df6403b87e94ecfd613202b5ed5988c8970
0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43
SH256 hash:
c8a7c219792b160acbcac815bffe8319001cd83997a988f4fd65f4e5d5541e75
MD5 hash:
51b14bbb5c40d5ba80c260045abd997e
SHA1 hash:
f17de677b71352b8d1003752bed418ab9e2a441b
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/79467823-c2a9-44ad-b83f-289504ebb725/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0c45dbdaf171/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0c45dbdaf171ab11f54426e63e1a7e8b2b7533c8df13382745cb674368ccea43

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/20877/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments