🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3856169b4cdd4e56c071bb202fb356c03527a19cdfe5561e1fff783994bc3bb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3856169b4cdd4e56c071bb202fb356c03527a19cdfe5561e1fff783994bc3bb1
SHA3-384 hash: 9300b4d7e01a804a3f18906d6b1410430a28e3cd7036dc0f49757d43807dad25017c43c3d690da55485d452f1832f8cd
SHA1 hash: efd0d0329fede333d95595008ec647bdbee18733
MD5 hash: e4684aca8a4e565c21d1c973f14ec8d8
humanhash: jig-cardinal-high-alaska
File name:14jon.js
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:1'408 bytes
First seen:2026-09-16 19:36:40 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24:f6jc2HgAZz/eAZlHI1/QgKOyCJd5YEpr11fesY4TUyg78SMhIjWW:f6jc87hlHItrTyCJd5YEppRLUQLIaW
TLSH T1CA21E24A789C75798B974200193E5C4A9DF9D70243FCE4DC8921F4A1C5FC0386BAD9C4
Magika javascript
Reporter skocherhan
Tags:AsyncRAT interactions-according-reports-syndication-trycloudflare-com js periods-genetic-stones-government-trycloudflare-com WsgiDAV


Avatar
skocherhan
https://interactions-according-reports-syndication.trycloudflare.com/14jon.js

Intelligence

File Origin
# of uploads :
1
# of downloads :
471
Origin country :
GB GB
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
attrib cmd evasive find lolbin obfuscated opendir persistence powershell repaired taskkill timeout
Link:
https://www.filescan.io/uploads/6aaaefeab3886a305d7e52ec/reports/7c0c603d-8ee4-4d42-af10-add46304fb89/overview
Verdict:
Suspicious
Labled as:
Trojan/JS.Obfuscated
Link:
https://www.hybrid-analysis.com/sample/3856169b4cdd4e56c071bb202fb356c03527a19cdfe5561e1fff783994bc3bb1
Verdict:
Adware
File Type:
js
First seen:
2026-09-16T18:22:00Z UTC
Last seen:
2026-09-18T15:40:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/3856169b4cdd4e56c071bb202fb356c03527a19cdfe5561e1fff783994bc3bb1/results?tab=lookup
Score:
93%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3856169b4cdd4e56c071bb202fb356c03527a19cdfe5561e1fff783994bc3bb1
Gathering data
Detection:
asyncrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3856169b4cdd4e56c071bb202fb356c03527a19cdfe5561e1fff783994bc3bb1/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-16 20:11:35 UTC
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hblbng2m3vhfnqdrxmqc7m2wya2spim437svmhq7754dtff4hoyq._file
Verdict:
malicious
Label(s):
AsyncRAT
Create hunting rule
DonutLoader
Create hunting rule
Link:
https://reports.threatray.com/44f410c0-77ac-45ec-8154-4fa84b1c6149
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default defense_evasion execution persistence privilege_escalation rat
Link:
https://tria.ge/reports/260916-ybwrnszs6l/
Behaviour
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
cURL User-Agent
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
Checks computer location settings
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Async RAT payload
Family: AsyncRat
Malware Config
C2 Extraction:
anarchy10.duckdns.org:1023
hsab20.duckdns.org:7878
benaditahd.duckdns.org:6745
Dropper Extraction:
https://periods-genetic-stones-government.trycloudflare.com/UkSep16MA.tar
https://periods-genetic-stones-government.trycloudflare.com/UkSep16ST.tar
https://periods-genetic-stones-government.trycloudflare.com/UkSep16SU.txt
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/3856169b4cdd4e56c071bb202fb356c03527a19cdfe5561e1fff783994bc3bb1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/James_inthe_box/status/2100227600216179161

Comments