🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BoratRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534
SHA3-384 hash: 21186dd6155e4468d3eb88c889d4a92ab251f8861dd544c880d4f2efc4499af8c31c94a34a77b2d180f964ce65e3d4e4
SHA1 hash: 4948e3391c58f50129e9d123791c63964e467d8e
MD5 hash: ef9e85a986b3a0f83edc9f395bdd1ccb
humanhash: eight-skylark-pennsylvania-steak
File name:ef9e85a986b3a0f83edc9f395bdd1ccb.exe
Download: download sample
Signature BoratRAT
Create hunting rule
File size:13'824 bytes
First seen:2026-09-02 08:11:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'697 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 192:1BLud0YIi2Htyo+rM6G/JbB87dhXMQhBqPpH2X9upJJbnnLudg:j40FFR36G/GMQhBqRWX9CnLmg
TLSH T10C527D11DFF5840AF1BB4F7A08F263436B31FB277522A2AEA84503591F26F40CD419B4
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:BoratRAT exe RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
UnamBinder
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b8fe10ef-035e-4614-ac4a-3c9385d9eaa3/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Suspicious activity
Analysis date:
2026-09-02 08:14:31 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e1716d26-38ab-495f-8cd2-c2de0e71586a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83639/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop20.23637.22294.11445.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac821b33c5a5135c70d8110
Tags:
infosteal rapid
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a process with a hidden window
Creating a file in the Windows directory
Creating a process from a recently created file
Creating a file
Creating a file in the %temp% directory
Deleting a recently created file
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Unauthorized injection to a recently created process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult base64 dropper packed
Link:
https://www.filescan.io/uploads/6a97da22d4e1ed1e35a9f911/reports/3768c95b-0d60-448b-9960-f54ac873e9ff/overview
Verdict:
Malicious
Labled as:
Generic.Generic
Link:
https://www.hybrid-analysis.com/sample/5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-30T00:29:00Z UTC
Last seen:
2026-09-03T19:39:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4af9c0f6-8e8e-4359-9595-b511618c991b
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1967209
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Drops executables to the windows directory (C:\Windows) and starts them
Encrypted powershell cmdline option found
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses dynamic DNS services
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1967209 Sample: 4r7Yc6pEsY.exe Startdate: 02/09/2026 Architecture: WINDOWS Score: 100 31 out-agent.duckdns.org 2->31 33 mr-b01.tm-azurefd.net 2->33 35 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->35 41 Antivirus detection for URL or domain 2->41 43 Antivirus / Scanner detection for submitted sample 2->43 45 Multi AV Scanner detection for submitted file 2->45 49 3 other signatures 2->49 8 4r7Yc6pEsY.exe 5 2->8         started        signatures3 47 Uses dynamic DNS services 31->47 process4 file5 27 C:\Windows\Fl00R_NuT.exe, PE32 8->27 dropped 29 C:\Users\user\AppData\...\4r7Yc6pEsY.exe.log, CSV 8->29 dropped 51 Encrypted powershell cmdline option found 8->51 53 Drops executables to the windows directory (C:\Windows) and starts them 8->53 12 Fl00R_NuT.exe 15 5 8->12         started        16 powershell.exe 23 8->16         started        signatures6 process7 dnsIp8 39 out-agent.duckdns.org 91.193.7.186, 49094, 49730 M247RO Japan 12->39 55 Antivirus detection for dropped file 12->55 57 Multi AV Scanner detection for dropped file 12->57 59 Reads the Security eventlog 12->59 61 Reads the System eventlog 12->61 18 WerFault.exe 21 16 12->18         started        21 conhost.exe 12->21         started        63 Loading BitLocker PowerShell Module 16->63 23 WmiPrvSE.exe 16->23         started        25 conhost.exe 16->25         started        signatures9 process10 dnsIp11 37 mr-b01.tm-azurefd.net 150.171.109.149, 443, 49736, 49741 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 18->37
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.65 Win 32 Exe x86
Link:
https://app.malva.re/file/ef9e85a986b3a0f83edc9f395bdd1ccb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534/
Threat name:
ByteCode-MSIL.Backdoor.AsyncRAT
Create hunting rule
Status:
Malicious
First seen:
2026-08-30 03:29:15 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkflehftfg4goi3ziio46w6ftzxrotngxa25kzim2d2q27cn6u2a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery
Link:
https://tria.ge/reports/260902-j3c2ba1zbs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Obfuscated Files or Information: Command Obfuscation
.NET Reactor proctector
Checks computer location settings
Executes dropped EXE
Unpacked files
SH256 hash:
5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534
MD5 hash:
ef9e85a986b3a0f83edc9f395bdd1ccb
SHA1 hash:
4948e3391c58f50129e9d123791c63964e467d8e
Link:
https://www.unpac.me/results/17d288e0-96ca-4b16-97d9-c7966dc6dc32/
SH256 hash:
ca11affc63c230591a524cb7cf5bfccad057631e3a7f8bd26ddaf42937c3f80f
MD5 hash:
c7ffb90a24676b99f8b4da43bf07637c
SHA1 hash:
02152a0d331b6ca90ad5371d7e209dec8564788e
Link:
https://www.unpac.me/results/17d288e0-96ca-4b16-97d9-c7966dc6dc32/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5a8ab21cb329b8672379421dcf5bc59e6f174da6b835d5650cd0f50d7c4df534

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/83639/

Comments