MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9
SHA3-384 hash: 42b8b9d3dcde11d35aa07fd2449af0b361ae244c41b3e03def5841ae5245f5d1eb841656db81e7e355269b09dbb2353b
SHA1 hash: 1ee094c8d737efc11e31ca90efe96fa6eda56426
MD5 hash: 9ae4b7fdcca3458b25d1ac6f92a6a343
humanhash: utah-sad-avocado-summer
File name:3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:22'327'296 bytes
First seen:2026-02-04 15:37:55 UTC
Last seen:2026-02-04 16:41:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'793 x AgentTesla, 19'692 x Formbook, 12'274 x SnakeKeylogger)
ssdeep 393216:l6JKUwRplBq7BvK6bR11/su6Yn0s4weuXA2siq+G9rWZ:cJRSlM7B5bHlsub0uQ2ibI
TLSH T1E12723B88C834975EB59C07C6631C701CDE5AF09BB385A5D38CD51098ADAEEFA84CD87
TrID 75.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.9% (.EXE) Win64 Executable (generic) (10522/11/4)
4.6% (.EXE) Win32 Executable (generic) (4504/4/1)
2.1% (.ICL) Windows Icons Library (generic) (2059/9)
2.1% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Neiki
Tags:AsyncRAT exe Telegram xbinder xworm

Intelligence

File Origin
# of uploads :
2
# of downloads :
211
Origin country :
DE DE
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6c561d5d-833b-4509-98f2-efb7fdee45fe/
Malware family:
n/a
ID:
1
File name:
NETFLIXPAIDPAIDAPI.exe
Verdict:
Malicious activity
Analysis date:
2026-02-04 14:00:53 UTC
Tags:
nuitka telegram auto-startup xworm auto-reg ims-api generic python rust pyinstaller
Link:
https://app.any.run/tasks/c764fea5-8b75-4b46-b463-ef4d57a096a8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51711/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=698351176b1af47db72ccf6a
Tags:
asyncrat autorun
Verdict:
Malicious
Labled as:
Jalapeno.Generic
Link:
https://www.hybrid-analysis.com/sample/3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-29T03:19:00Z UTC
Last seen:
2026-02-04T18:20:00Z UTC
Hits:
~10
Detections:
Backdoor.XWorm.HTTP.C&C PDM:Trojan.Win32.Tasker.cust Backdoor.Agent.TCP.C&C HEUR:Trojan-Dropper.MSIL.Dapato.gen HEUR:Backdoor.MSIL.XWorm.gen Backdoor.MSIL.XWorm.a PDM:Trojan.Win32.Generic Trojan.Win32.Agent.sb HEUR:Backdoor.MSIL.XClient.b Backdoor.MSIL.XWorm.c Backdoor.MSIL.XWorm.b
Link:
https://opentip.kaspersky.com/3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.87 Win 32 Exe x86
Link:
https://app.malva.re/file/9ae4b7fdcca3458b25d1ac6f92a6a343
Gathering data
Verdict:
Malicious
Threat:
Family.XBINDER
Link:
https://tip.neiki.dev/file/3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9
Threat name:
Win32.Spyware.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2026-01-24 02:09:20 UTC
File Type:
PE (.Net Exe)
Extracted files:
21
AV detection:
28 of 36 (77.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzz5odcsg75obb7lgtxoq2vthgh75rnbdnwzv5taqkhwoyw2zwuq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
error
AsyncRAT
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery execution persistence rat trojan
Link:
https://tria.ge/reports/260204-s28w2ads4c/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Drops startup file
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
ItzJrx-35702.portmap.host:6789
72.62.162.170:6789
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3e73d70c5237/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.threat.rip/file/3e73d70c5237fae087eb34eee86ab3398ffec5a11b6d9af660828f6762dacda9
Cape
Cape
https://www.capesandbox.com/analysis/51711/

Comments