MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AsyncRAT
Vendor detections: 21
| SHA256 hash: | 4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae |
|---|---|
| SHA3-384 hash: | 837cf5b71b6f9c484ec24e59f39f4ae18e894ffbdaa8446f6d351b58a18bbd537e541832929b3f466079c5c9f90ec7a2 |
| SHA1 hash: | c6eef75fe289f56c4b6e7e02594b5c0ad120dcdc |
| MD5 hash: | 0209e6d12d95353e0cf11bf7477d1b52 |
| humanhash: | lithium-cardinal-asparagus-pasta |
| File name: | AVISO DE CHEGADA - LRAN16014S.pdf.exe |
| Download: | download sample |
| Signature | AsyncRAT |
| File size: | 980'480 bytes |
| First seen: | 2025-10-27 19:32:35 UTC |
| Last seen: | 2025-11-06 11:09:12 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1895460fffad9475fda0c84755ecfee1 (456 x Formbook, 155 x AgentTesla, 79 x a310Logger) |
| ssdeep | 24576:X5EmXFtKaL4/oFe5T9yyXYfP1ijXdaJEyY+:XPVt/LZeJbInQRaJ |
| Threatray | 2'054 similar samples on MalwareBazaar |
| TLSH | T179259D0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D79BE701B1563E7A3 |
| TrID | 40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| dhash icon | aae2f3e38383b629 (2'698 x Formbook, 1'203 x CredentialFlusher, 928 x AgentTesla) |
| Reporter |  cocaman |
| Tags: | AsyncRAT exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
166
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Factura_9484_JPEG File.rar
Verdict:
Suspicious activity
Analysis date:
2025-10-27 19:09:44 UTC
Tags:
arch-scr github auto-startup auto-reg xworm
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Verdict:
Malicious
Score:
91.7%
Tags:
underscore autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Launching a process
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Connection attempt to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
adaptive-context autoit cmdkey compiled-script control evasive fingerprint formbook keylogger lolbin masquerade microsoft_visual_cc obfuscated packed packed packer_detected threat
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-22T11:55:00Z UTC
Last seen:
2025-10-28T11:36:00Z UTC
Hits:
~100
Detections:
Backdoor.MSIL.XWorm.a Trojan-PSW.Win32.Stealer.sb Trojan-Dropper.Win32.Injector.sb Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb HEUR:Trojan.Script.AUO.gen PDM:Trojan.Win32.Generic PDM:Trojan.Win32.Badex.d Backdoor.Agent.TCP.C&C Trojan.Win32.Agent.sb Backdoor.Win32.Androm Backdoor.MSIL.XWorm.b
Malware family:
XWorm
Verdict:
Malicious
Result
Threat name:
XWorm
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: Suspicious Double Extension File Execution
Switches to a custom stack to bypass stack traces
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected XWorm
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
Malware
YARA:
6 match(es)
Tags:
AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Suspect Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.XWORM
Threat name:
Win32.Trojan.AutoitInject
Status:
Malicious
First seen:
2025-10-22 16:21:54 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
27 of 36 (75.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
unc_loader_036
xworm
Similar samples:
+ 2'044 additional samples on MalwareBazaar
Result
Malware family:
xworm
Score:
10/10
Tags:
family:xworm discovery persistence rat trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Executes dropped EXE
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
216.9.224.196:2233
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae
MD5 hash:
0209e6d12d95353e0cf11bf7477d1b52
SHA1 hash:
c6eef75fe289f56c4b6e7e02594b5c0ad120dcdc
SH256 hash:
0301a45b45d2e8086dd292d26913d18253eafec79ae1c8641ce5017c841db9f3
MD5 hash:
31b106a348cd2d05d975d1d761fd71f9
SHA1 hash:
61be3bd982a773e8ad259b1dd19d4e15147fba2f
Detections:
win_xworm_a0
win_xworm_w0
XWorm
win_xworm_bytestring
win_mal_XWorm
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
MALWARE_Win_AsyncRAT
MALWARE_Win_XWorm
Parent samples :
996e1fb1c8add4d61063edc2e1108ae2f0f05e6d49f48c178d261f9f959580d2
0fe9f112bd5710b6c24c763df4e017419f1d5e972454fa2675218a96b33388f6
5b15d6aa50b161172a6f060eb4f5100cc376b34dc70f71abf644e892d723bbda
7e5556fc4b8a737f35a805afa28c9f53c2ed194a4cca767a568725c5c9ccbee7
16f52bdce049aa521cfd843f1425ead60bb4386698fb06ec7a3af59ddce20172
4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae
07cc70d80281cdb146cccd3de6aaf2a5011901328bc5def66f9ede21a2fb0042
0fe9f112bd5710b6c24c763df4e017419f1d5e972454fa2675218a96b33388f6
5b15d6aa50b161172a6f060eb4f5100cc376b34dc70f71abf644e892d723bbda
7e5556fc4b8a737f35a805afa28c9f53c2ed194a4cca767a568725c5c9ccbee7
16f52bdce049aa521cfd843f1425ead60bb4386698fb06ec7a3af59ddce20172
4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae
07cc70d80281cdb146cccd3de6aaf2a5011901328bc5def66f9ede21a2fb0042
Malware family:
XWorm
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | AutoIT_Compiled |
|---|---|
| Author: | @bartblaze |
| Description: | Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious. |
| Rule name: | ByteCode_MSIL_Backdoor_AsyncRAT |
|---|---|
| Author: | ReversingLabs |
| Description: | Yara rule that detects AsyncRAT backdoor. |
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | Detect_PowerShell_Obfuscation |
|---|---|
| Author: | daniyyell |
| Description: | Detects obfuscated PowerShell commands commonly used in malicious scripts. |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows executables referencing non-Windows User-Agents |
| Rule name: | MALWARE_Win_AsyncRAT |
|---|---|
| Author: | ditekSHen |
| Description: | Detects AsyncRAT |
| Rule name: | MALWARE_Win_XWorm |
|---|---|
| Author: | ditekSHen |
| Description: | Detects XWorm |
| Rule name: | Multifamily_RAT_Detection |
|---|---|
| Author: | Lucas Acha (http://www.lukeacha.com) |
| Description: | Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | Njrat |
|---|---|
| Author: | botherder https://github.com/botherder |
| Description: | Njrat |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | SUSP_DOTNET_PE_List_AV |
|---|---|
| Author: | SECUINFRA Falcon Team |
| Description: | Detecs .NET Binary that lists installed AVs |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | TH_Generic_MassHunt_Win_Malware_2025_CYFARE |
|---|---|
| Author: | CYFARE |
| Description: | Generic Windows malware mass-hunt rule - 2025 |
| Reference: | https://cyfare.net/ |
| Rule name: | Windows_Trojan_XWorm_b7d6eaa8 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_xworm_bytestring |
|---|---|
| Author: | Matthew @ Embee_Research |
| Description: | Detects bytestring present in unobfuscated xworm |
| Rule name: | win_xworm_w0 |
|---|---|
| Author: | jeFF0Falltrades |
| Description: | Detects win.xworm. |
| Rule name: | xworm |
|---|---|
| Author: | jeFF0Falltrades |
| Rule name: | xworm_kingrat |
|---|---|
| Author: | jeFF0Falltrades |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.