MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13319afc687da5ca1be0d684d6fd05eb3bbff5a7e3a29606592a07c20f5d66d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	13319afc687da5ca1be0d684d6fd05eb3bbff5a7e3a29606592a07c20f5d66d1
SHA3-384 hash:	57ac00f2ff0d62875e0c53617365f050540d87d3baf8e59903365be0bd3e5d6dbc8e365ff2fb124796ec2906b33ce250
SHA1 hash:	180fbdee06ae26573e4571177e9197b8be67accb
MD5 hash:	7c73daaa7299ab7cbc139dccbe35d940
humanhash:	emma-juliet-april-georgia
File name:	PhF191.bat
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	2'276 bytes
First seen:	2026-02-23 09:08:40 UTC
Last seen:	2026-02-23 09:10:09 UTC
File type:	bat
MIME type:	text/plain
ssdeep	48:1o/BfScAObEpEu+3tj0udzokhinnZjmZGJtZkCdJ1/pHhBaJr:1o/nEGXj2khiZjeGFkC1pHhEZ
Threatray	360 similar samples on MalwareBazaar
TLSH	T172413F422CE662314122DA77B22842C6F95E33874F81E6CC3A81818D2B5D2D3CBDF886
TrID	45.4% (.MP3) MP3 audio (ID3 v1.x tag) (2500/1/1) 36.3% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 18.1% (.MP3) MP3 audio (1000/1)
Magika	batch
Reporter	JAMESWT_WT
Tags:	AsyncRAT bat WsgiDAV

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

124

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN dcrat

Malware family:

dcrat

Alert

Create hunting rule

ID:

1

File name:

https://vmsteeltech.in/Taxform-2a9d7j4h2.zip

Verdict:

Malicious activity

Analysis date:

2026-02-22 02:12:25 UTC

Tags:

webdav python xworm rat dcrat remote darkcrystal asyncrat amsi-bypass

Link:

https://app.any.run/tasks/c24a8016-b5a0-405d-aca4-729cb311275e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/54178/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.BadBatObs.31934.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699c193ec950ab5d9ab0bbce

Tags:

autorun dropper shell sage

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a file

Creating a process from a recently created file

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Sending a custom TCP request

DNS request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm cscript evasive explorer fingerprint lolbin obfuscated timeout wscript

Link:

https://www.filescan.io/uploads/699c193a10e80629d4ee0fee/reports/68e43969-fbde-4fa9-b981-a667e1dc56ff/overview

Hybrid Analysis DR/SNH

Verdict:

Suspicious

Labled as:

DR/SNH

Link:

https://www.hybrid-analysis.com/sample/13319afc687da5ca1be0d684d6fd05eb3bbff5a7e3a29606592a07c20f5d66d1

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan.BAT.Alien.gen

Link:

https://opentip.kaspersky.com/13319afc687da5ca1be0d684d6fd05eb3bbff5a7e3a29606592a07c20f5d66d1/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/13319afc687da5ca1be0d684d6fd05eb3bbff5a7e3a29606592a07c20f5d66d1/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/13319afc687da5ca1be0d684d6fd05eb3bbff5a7e3a29606592a07c20f5d66d1

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-23 09:05:38 UTC

File Type:

Text (Batch)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cmyzv7dipws4ug7a22cnn7if5m5375nh4orjmbszfid4ed25m3iq._file

Threatray xworm donutloader asyncrat

Verdict:

malicious

Label(s):

xworm

Alert

Create hunting rule

donutloader

Alert

Create hunting rule

asyncrat

Alert

Create hunting rule

Similar samples:

534b8130a00712c5ecc8a0bfd19c89657c69d519d2fa02e889bc9ba415732cd6

AsyncRAT

7b910a8a522431771087495724fb30ee1620d2490fb5aa7e77ba9114545a05ea

AsyncRAT

9f8033bf9e669aa8043f46733f73dd933ebe06eb4bbf7b3ccef3520bf4921598

AsyncRAT

a70129ec6f019339caa01a1cddc49494b87285a7b51bf0f4a2934d55c413e2ce

AsyncRAT

b1b4ffcd21342c7de7f0bc286eb3f4ec6a5b919df5f20d383b4df0bd462cbe48

AsyncRAT

b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800

AsyncRAT

c11d635651a84fd8d64af5024af9d691bb790938c07a6bf1521c1ba54b734a0a

AsyncRAT

d42b3db1a4f5233ab5e2c1605d3ee3c94983cd7241f42602a1f10fad754cb2f2

AsyncRAT

error

AsyncRAT

f545d644196419b41eadae3f0846888c396284cc148c780916c0d96a07f71b40

AsyncRAT

f97a6429797b77f052c74788515669857c47e4273fa01d5eebb39024d639ba49

AsyncRAT

+ 350 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion

Link:

https://tria.ge/reports/260223-k4kcfsb13d/

Behaviour

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Drops startup file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.23

Link:

https://yomi.yoroi.company/submissions/13319afc687da5ca1be0d684d6fd05eb3bbff5a7e3a29606592a07c20f5d66d1

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/54178/