MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640
SHA3-384 hash:	6386255dd0e77d94f6931f71284c30a347b77c3f30f8f61f68592883372d268b7c1beff22f8784f5d566ccc089b597b5
SHA1 hash:	33315c0906a83e46f62686ed71b6956aed30e868
MD5 hash:	ff3bbc4ca5b236727a1c0cfdacc770bb
humanhash:	jersey-oranges-zulu-cat
File name:	sample_product inquirywa004678.hta
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	1'686'072 bytes
First seen:	2026-07-21 09:44:20 UTC
Last seen:	Never
File type:	hta
MIME type:	text/plain
ssdeep	192:5pxIahuv6OeK6LVLqvsbzRVX/Al8/Zmr7:5b9huvitJqvsbzRta8Qr7
TLSH	T1087515E74ED8C483F4252626DE099034FA7287627EFF266F70F376885B21055886C9F6
Magika	txt
Reporter	JAMESWT_WT
Tags:	AsyncRAT hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f3f86bcffb2c48cb7b0d9

Tags:

shell spawn sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640/results/dashboard

Payload URLs

URL

File name

https://pub-e17adc2984a64a2f8f2a3f402fd92e53.r2.dev/ikzwhpl.png

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

downloader

Link:

https://www.filescan.io/uploads/6a5f4f7cc16e5ef6f54ac413/reports/f8e8c23b-7285-4c00-8109-c53b3996b884/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

js

First seen:

2026-07-15T21:33:00Z UTC

Last seen:

2026-07-22T08:06:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640/results?tab=lookup

Nucleon Malprob Benign

Score:

16%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/ff3bbc4ca5b236727a1c0cfdacc770bb

CERT.PL MWDB asyncrat

Detection:

asyncrat

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640/

ReversingLabs TitaniumCloud Script-JS.Trojan.Acsogenixx

Threat name:

Script-JS.Trojan.Acsogenixx

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-21 10:53:26 UTC

File Type:

Binary

AV detection:

9 of 36 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cysmwzm5vn33ivn43h6a4edcc3gctlsehozuipa7vypkhmbj6zaa._file

Threatray AsyncRAT

Verdict:

malicious

Label(s):

AsyncRAT

Alert

Create hunting rule

Link:

https://reports.threatray.com/053331cb-1d7a-4509-b367-6814ef34fedb

Similar samples:

5e088f3ae8bf2631e5aaa8de2facd537a65ef5e269924213e14ee41d94b6a446

AsyncRAT

7f14cf5740bb204942ae69690aea4bb17dea9bee17323311a6613c766a716b24

AsyncRAT

ada3a2598dc763b860c98236f6ff09f8be2890da1c5fb53539a6d19b065d9620

AsyncRAT

c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3

AsyncRAT

e5cc1cac795755ade9067768ac3a2d037ab18977e4223291d55e636663a3d282

AsyncRAT

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default discovery execution persistence rat suricata

Link:

https://tria.ge/reports/260721-mysgzsdv4m/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: PowerShell

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Family: AsyncRat

Process spawned unexpected child process

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

Malware Config

C2 Extraction:

contabili.balanteo.shop:6606

VMRay AsyncRAT

Malware family:

AsyncRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1624cb659dab/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640