MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 543b167817b1f76bf7619302fc0118659029423ef4211e9903b73fe1fc8c1bb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments 1

SHA256 hash:	543b167817b1f76bf7619302fc0118659029423ef4211e9903b73fe1fc8c1bb0
SHA3-384 hash:	24d43060aee3e0ebd51773a6ab9c1908b76834d8b0165dd1516787d3700ab03ae0989ec08785195e6723b4b70a8701d7
SHA1 hash:	431a8fe597748f47c79849f6f9c0326bd7365655
MD5 hash:	5d1ca1a7d085e4933b739caef34d65d6
humanhash:	eight-may-nebraska-pluto
File name:	uber.wsf
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	1'808 bytes
First seen:	2025-08-14 09:04:44 UTC
Last seen:	2025-08-14 09:04:59 UTC
File type:
MIME type:	text/xml
ssdeep	48:cjDQWCo2qypF0n4R0E76eBVRY78aFf4jLJRrpQ6NE8+Fw:Kf54/04RTxRS8OgLT9p++
TLSH	T14C31CB46F903AE2C85778A7A586AF85DF78912BF0045886AB50C48AE4F3B3ED44C0988
TrID	61.5% (.WSF) Windows Script File (8000/1/2) 38.4% (.XML) Generic XML (ASCII) (5000/1)
Magika	vba
Reporter	0xb0mb3r
Tags:	AsyncRAT stager vbs wsf xworm

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

PUA.Win.Trojan.Script-44

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689da6f631e468d93724b804

Tags:

virus spawn sage

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/543b167817b1f76bf7619302fc0118659029423ef4211e9903b73fe1fc8c1bb0

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/543b167817b1f76bf7619302fc0118659029423ef4211e9903b73fe1fc8c1bb0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/543b167817b1f76bf7619302fc0118659029423ef4211e9903b73fe1fc8c1bb0/

Verdict:

Malicious

Threat:

Trojan.JS.SAgent

Link:

https://tip.neiki.dev/file/543b167817b1f76bf7619302fc0118659029423ef4211e9903b73fe1fc8c1bb0

Threat name:

Script-WScript.Downloader.AsyncRAT

Status:

Malicious

First seen:

2025-08-14 09:05:49 UTC

File Type:

Text (XML)

Extracted files:

AV detection:

8 of 38 (21.05%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kq5rm6axwh3wx53bsmbpyaiymwicsqr66qqr5gidw476d7emdoya._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/250814-k2lshadq5t/

Behaviour

Runs net.exe

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Enumerates connected drives

Checks computer location settings

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/543b167817b1f76bf7619302fc0118659029423ef4211e9903b73fe1fc8c1bb0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.