🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c
SHA3-384 hash: 41f46590fcb9484b851b70b79587203281beab58de08c7729468b90642225617a7ddead33bd30240cdea83842f473c8f
SHA1 hash: 3b371ec7241cf7e8876c8b992f43e1818302ae2e
MD5 hash: 96475961afb64c43415f862c77b9060a
humanhash: eight-uranus-zebra-minnesota
File name:65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:749'568 bytes
First seen:2026-09-10 11:11:43 UTC
Last seen:2026-10-19 07:21:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'290 x AgentTesla, 20'698 x Formbook, 12'401 x SnakeKeylogger)
ssdeep 12288:pE8peMUOLAF5RWA66JGz22o2eZfjuHLLdbl1sLxoJ7IWeJcX3rAbbAdIV4T/TL3U:pE8peyAhD6pX+ZfML9sVS7pUbbAdlT/+
TLSH T179F4121533991F5AD27E47FA2BD1120113F2A9632BB1F58C5ECA32EB9A72F404B14E53
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/568b10a4-d7e4-49f6-8043-8bc1059cfbac/
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/84931/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac96ca5874bb415d07c923c
Tags:
infosteal stration micro shell
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Launching a process
Creating a file
Сreating synchronization primitives
Blocking the Windows Defender launch
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Forced shutdown of a system process
Connection attempt to an infection source
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-26T04:24:00Z UTC
Last seen:
2026-09-11T07:15:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5a65a7e9-c938-48bd-be55-12ddb1149265
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.40 Win 32 Exe x86
Link:
https://app.malva.re/file/96475961afb64c43415f862c77b9060a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2026-09-06 05:41:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
18 of 23 (78.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mw53optgo4lwuv5spofdw52g6y6srwddeelfspwr23dshm5xebga._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery evasion execution persistence rat trojan
Link:
https://tria.ge/reports/260910-na2lesbm3s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Modifies Windows Defender DisableAntiSpyware settings
Malware Config
C2 Extraction:
217.60.195.74:443
Unpacked files
SH256 hash:
65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c
MD5 hash:
96475961afb64c43415f862c77b9060a
SHA1 hash:
3b371ec7241cf7e8876c8b992f43e1818302ae2e
Link:
https://www.unpac.me/results/149d1b1b-bd29-4b93-8c1b-d008c4961322/
SH256 hash:
95aa56043ce630cd5379b8d56cf8040b206d9858efa89d38a31874f27387e500
MD5 hash:
8dcb38efc32b85ed7c03cf41abb9de7c
SHA1 hash:
4e0efa6f6b9e91da6502c7b6ca6449ce7c93aafa
Link:
https://www.unpac.me/results/149d1b1b-bd29-4b93-8c1b-d008c4961322/
SH256 hash:
544ec63418781e8a06b58732c3488377fc1ee3eb6d5e5ec41d5098cb6f369f90
MD5 hash:
01ada0a92a5fb4285cb08427f1e3fdfa
SHA1 hash:
84556edb9541da717f987d19cf16ee5c2116c918
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_AsyncRAT
Create hunting rule
MALWARE_Win_XWorm
Create hunting rule
win_mal_XWorm
Create hunting rule
Link:
https://www.unpac.me/results/149d1b1b-bd29-4b93-8c1b-d008c4961322/
Parent samples :
50d45ea5f67cd018b72fbcced629ce9159a7b914750adc78f6e4f29c866db426
5fce174beeacb448a07bc69c36a1cfe043e87c26a94ace39e632f734ba04a618
97ef870406a1f48080539a324094cdb9eae8f41aeafdc8be86f4c4aaa5a4f14e
65bbb73e6677176a57b27b8a3b7746f63d28d8632116593ed1d6c723b3b7204c
8a148ed494d7e89568338a44439a4b94426c427030281ecbe9d6a42803c22c41
f772bb2f5fb2012f926c1e370cae536c76676b64f1368724a511518ea0c20c26
SH256 hash:
74a21b42b426e2261a49b1c3f194ade11c9ce8dcd4004bef35027469587b8d3c
MD5 hash:
ec54a1c30826f288921d0bdf8cd7a3fa
SHA1 hash:
b6bd86d156286e5cf4f8e192da325438fcfae508
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/149d1b1b-bd29-4b93-8c1b-d008c4961322/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/65bbb73e6677/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/84931/

Comments