MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069
SHA3-384 hash:	2ca4de082a9e44077fec2f22df437fbaa72239eb82855b324b701dcdfe1555f51a5f211014c014f22ed5ec77d7ae9b38
SHA1 hash:	e22c05e7ec4147eddeab8abd5ac5a10d6e3efae9
MD5 hash:	83d9bf538d7809c98f331d469b48e083
humanhash:	wolfram-august-ten-pizza
File name:	rar.rar
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	3'344 bytes
First seen:	2026-07-21 09:44:07 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	48:Gzjb9HUQx3p1Djrg5CViZcqSKCCEhwT9AKgIsm5HfPVgg1RyG8juo+4Agj3Q:GzjJ0q574t6wJzXsm/PV9h8juo+4RA
TLSH	T137614CEA743BE608E9551BB2416FE490B6853CB93DB57A79F4BB03028D7C454082F1F2
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	JAMESWT_WT
Tags:	AsyncRAT ikzwhpl rar

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	sample_product inquirywa004678.hta
File size:	1'686'072 bytes
SHA256 hash:	1624cb659dab77b455bcd9fc0e106216cc29ae443bb3443c1fae1ea3b029f640
MD5 hash:	ff3bbc4ca5b236727a1c0cfdacc770bb
MIME type:	text/plain
Signature	AsyncRAT

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/dd6dde29-4854-406c-89f9-392256df1cbe/

ClamAV Detected

Detection(s):

SecuriteInfo.com.HTML.HideMe-22.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5f3f86bcffb2c48cb7b0d9

Tags:

shell spawn sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-21T07:25:00Z UTC

Last seen:

2026-07-21T07:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/83d9bf538d7809c98f331d469b48e083

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-22 21:36:00 UTC

AV detection:

12 of 24 (50.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gvs2piv3mmrvpq27nsu6tdvqqpqvavjg6cvq4tmi34qwfgkuabuq._file

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default discovery execution persistence rat suricata

Link:

https://tria.ge/reports/260721-mmfztaey3v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Command and Scripting Interpreter: PowerShell

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Badlisted process makes network request

Family: AsyncRat

Process spawned unexpected child process

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

Malware Config

C2 Extraction:

contabili.balanteo.shop:6606

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3565a7a2bb632357c35f6ca9e98eb083e1505526f0ab0e4d88df216299540069