🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19
SHA3-384 hash: 25d7038879c6a97e6e5ff3cf26de6800dbcca817251cb6142172db501d95fdbd87b8511d2fbd9982f0a7160a27016c1a
SHA1 hash: 7d64a644d8a36da7188ed6ffd41e1db0cb9c35f1
MD5 hash: 2643d603d7ab8745978cd1ee44f18a39
humanhash: carpet-social-hawaii-charlie
File name:Factura n 679 del 24072026.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:807'424 bytes
First seen:2026-07-27 17:05:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'296 x AgentTesla, 20'714 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 12288:yJqLPgI38zYLcnhfR+u/VsJLjcIGDv/wksyR50CeidRV9gRKStRiHAkY9mc97BeZ:Dgk8G4+muhjCDv/wkspWfIZ/E9b0BeZ
TLSH T1CD051246675ADB13E6AB1FF819B3E8701374AEAEA521D2064FC5BCEB75337189804313
TrID 72.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win64 Executable (generic) (6522/11/2)
4.4% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon e0e2aba3a5b8b8a8 (60 x AgentTesla, 23 x Formbook, 18 x SnakeKeylogger)
Reporter James_inthe_box
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/cc4b87ab-a157-42d0-a08c-06a96fd6d132/
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/76460/
Detection(s):
Win.Trojan.Spynoon-9939401-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a file
DNS request
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
agenttesla base64 masquerade packed
Link:
https://www.filescan.io/uploads/6a678feb72db6e8f339d2df4/reports/f06e7177-6e6e-4ef9-9196-90f26f3ede8c/overview
Verdict:
Malicious
Labled as:
AgentTesla.Generic
Link:
https://www.hybrid-analysis.com/sample/1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-27T12:51:00Z UTC
Last seen:
2026-07-29T11:18:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/1dcd15fe-0626-407b-84fe-52b7fc4cb29e
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.60 Win 32 Exe x86
Link:
https://app.malva.re/file/2643d603d7ab8745978cd1ee44f18a39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19/
Threat name:
Win32.Trojan.PureLogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-07-27 17:05:31 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dqdhv5lgljrosjiuqteuxuxczpdtj6l46hdsip3cdgnl7k7uhumq._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/63730039-1f9c-4041-a1e4-6a5945a3cd8d
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/260727-vl9vhaam21/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
carrenzaalwarex.ddns.net:7004
Unpacked files
SH256 hash:
1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19
MD5 hash:
2643d603d7ab8745978cd1ee44f18a39
SHA1 hash:
7d64a644d8a36da7188ed6ffd41e1db0cb9c35f1
Link:
https://www.unpac.me/results/27cd0f5c-d523-4a9a-81d7-c5ed2aaa57dc/
SH256 hash:
166c43c485860abcbddc8d17100f864bbd3a4d1b0c9bf902033863f89dee6237
MD5 hash:
be28bc4c126cd98cf5a69d68c1e8f80d
SHA1 hash:
53abb9b1acb7752feedaae670ec148249afc3bd2
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
Link:
https://www.unpac.me/results/27cd0f5c-d523-4a9a-81d7-c5ed2aaa57dc/
Parent samples :
1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19
0a50174b6ef5b50a5d26fd07855446697d6d8145d5162a8df3de50c6e54aaad9
dea0649857c76ceabba2ac3ecb1aa5960e92f1a5ef80b385a75903aa7edd2c3d
46038f8f6f10cbee2ea6654ab97a7664365087b7b86bb3ee783ae0428a411eb4
5b636ca0d5d324942c7ed1f8b194fa9d8ad64a8d77596e6fe36fcc4c2c2b1486
594192542dd1221ccb2f04f72d23c6e8422cfa87e7d41aaa10f1e16f1aba1035
SH256 hash:
706785a27684fb951d30e9cecca9f6c88e80d83ef991fb122bd4cd39108da65e
MD5 hash:
b4c476e7d96aff8b11e9338d097b3350
SHA1 hash:
95d118be5adda798302bbfe1c79ca14b2167b2c4
Link:
https://www.unpac.me/results/27cd0f5c-d523-4a9a-81d7-c5ed2aaa57dc/
SH256 hash:
47a856ff7d9bf14949f9a1deed4ba4ec9495a9ef95ee41ba6d78f630561d166c
MD5 hash:
332b4cd85d1b878f5c5bf709b5984644
SHA1 hash:
ddba69ce01e7ea28029d271d4dd2f75bc3bf454f
Link:
https://www.unpac.me/results/27cd0f5c-d523-4a9a-81d7-c5ed2aaa57dc/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c067af5665a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/76460/

Comments