🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f131d7bf6e378ee93d3506a2e9ecf5fd01d6e5c2bea70876218c7cf44dbf9f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 65 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f131d7bf6e378ee93d3506a2e9ecf5fd01d6e5c2bea70876218c7cf44dbf9f5
SHA3-384 hash: 849e9e08511552981a6b606f2eba20457d6685c2f8307c23ddc693394e7698ceafe2af9049527945d552cae573814de3
SHA1 hash: 9576bc0c8530d0ca73318f5fbf33c6738081cbbb
MD5 hash: b5cc0517d023fa66a3670c248d7306ac
humanhash: oven-harry-sixteen-triple
File name:extracted-exe.zip
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:17'365'084 bytes
First seen:2025-05-21 17:13:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:ZEl+iBwbYMAEBM86CMeRYFKEwnT3shUvsKc:Ol+LcyBXprYFKEwTpg
TLSH T19C07332C47C69123E433BE02352EABD0FB144F590AB89596DECC53EFB45F68156E892C
Magika zip
Reporter burger
Tags:AsyncRAT NjRAT RedLineStealer zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
NL NL
File Archive Information

This file archive contains 6 file(s), sorted by their relevance:

File name:Keylogger.exe
File size:10'240 bytes
SHA256 hash: b2a992052d32a5b9d3702350b133289b45a8d209acd0161d9c3b0bc6fd702b3c
MD5 hash: b8607b7921cd9cba78058fcb56bcfb9d
MIME type:application/x-dosexec
Signature RedLineStealer
File name:Client.exe
File size:68'096 bytes
SHA256 hash: 3a7efdc3d85adf7a5484ef17549db47be2a78b4b6892d93dd91958bb9a9edb82
MD5 hash: 3935ef8202cd8040741138a14b0655f0
MIME type:application/x-dosexec
Signature AsyncRAT
File name:DevExpress.WinRTPresenter.Launcher.exe
File size:13'312 bytes
SHA256 hash: 76a868948e5b4df73f5dab5606135f6bf10b598bdaa991737224edcb8fdd58db
MD5 hash: de4449ac523ac31f66efe7f090360f71
MIME type:application/x-dosexec
Signature AsyncRAT
File name:Venom RAT + HVNC + Stealer + Grabber.exe
File size:14'868'480 bytes
SHA256 hash: 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58
MD5 hash: 3b3a304c6fc7a3a1d9390d7cbff56634
MIME type:application/x-dosexec
Signature njrat
File name:Venom RAT + HVNC + Stealer + Grabber.exe.config
File size:3'317 bytes
SHA256 hash: 0aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5
MD5 hash: a1c2a2870001b66db41bcb020bff1c2d
MIME type:text/xml
Signature AsyncRAT
File name:Venom RAT Patcher.exe
File size:14'922'752 bytes
SHA256 hash: 22210f9b65f1362ae69384db4a3ef8e780c78e01dbdcb8b490063746ddb5f1c6
MD5 hash: 3253729a2f9ef995967aa2783a146d07
MIME type:application/x-dosexec
Signature AsyncRAT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682e0a422f280a98fb42dc9c
Tags:
asyncrat dropper virus msil
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm asyncrat base64 configsecuritypolicy evasive fingerprint hacktool lolbin mpcmdrun msconfig njrat njrat obfuscated rat razy reconnaissance regedit schtasks vbnet venomrat
Link:
https://www.filescan.io/uploads/682e09f42d1d8b12425cd0d9/reports/99e6dd7a-4f73-4909-bae3-793ac89a49c9/overview
Verdict:
Suspicious
Labled as:
Trojan.Downloader.dd
Link:
https://www.hybrid-analysis.com/sample/5f131d7bf6e378ee93d3506a2e9ecf5fd01d6e5c2bea70876218c7cf44dbf9f5
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/5f131d7bf6e378ee93d3506a2e9ecf5fd01d6e5c2bea70876218c7cf44dbf9f5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f131d7bf6e378ee93d3506a2e9ecf5fd01d6e5c2bea70876218c7cf44dbf9f5/
Threat name:
ByteCode-MSIL.Backdoor.MarteVenomRAT
Create hunting rule
Status:
Malicious
First seen:
2025-05-21 17:14:29 UTC
File Type:
Binary (Archive)
Extracted files:
590
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l4jr267w4n4o5e6tkbvc5hwpl7ib23s4fpvhbb3cddd46rg37h2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f131d7bf6e378ee93d3506a2e9ecf5fd01d6e5c2bea70876218c7cf44dbf9f5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AcRat
Create hunting rule
Author:Nikos 'n0t' Totosis
Description:AcRat Payload (based on AsyncRat)
Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:Base64_decoding
Create hunting rule
Author:iam-py-test
Description:Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)
Rule name:CHM_File_Executes_JS_Via_PowerShell
Create hunting rule
Author:daniyyell
Description:Detects a Microsoft Compiled HTML Help (CHM) file that executes embedded JavaScript to launch a messagebox via PowerShell
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Discord_APIs
Create hunting rule
Rule name:dsc
Create hunting rule
Author:Aaron DeVera
Description:Discord domains
Rule name:EXE_VenomRAT_May_2024
Create hunting rule
Author:NDA0E
Description:Detects VenomRAT
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:INDICATOR_SUSPICIOUS_EXE_DcRatBy
Create hunting rule
Author:ditekSHen
Description:Detects executables containing the string DcRatBy
Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
Create hunting rule
Author:ditekSHen
Description:Detects executables (downlaoders) containing URLs to raw contents of a paste
Rule name:INDICATOR_SUSPICIOUS_EXE_TelegramChatBot
Create hunting rule
Author:ditekSHen
Description:Detects executables using Telegram Chat Bot
Rule name:INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
Create hunting rule
Author:ditekSHen
Description:Detects executables attemping to enumerate video devices using WMI
Rule name:MALWARE_Win_VenomRAT
Create hunting rule
Author:ditekSHen
Description:Detects VenomRAT
Rule name:MAL_AsnycRAT
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:MAL_AsyncRAT_Config_Decryption
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:Mal_WIN_AsyncRat_RAT_PE
Create hunting rule
Author:Phatcharadol Thangplub
Description:Use to detect AsyncRAT implant.
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API
Rule name:venomrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Windows_Generic_Threat_ce98c4bc
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Donutloader_f40e3759
Create hunting rule
Author:Elastic Security
Rule name:win_asyncrat_unobfuscated
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments