MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
SHA3-384 hash: 8bf89ac449ae08bbf2260e67ec6ea96c10c641d547cd9a3554145ba4b5d81e71a26f353720a0c2379c115f48293b1444
SHA1 hash: c98556c2b239d8ab55658fe97f212640bf98cbef
MD5 hash: 7051fba1656e9cb1114fa39804c5cb91
humanhash: pennsylvania-kilo-twenty-romeo
File name:691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:776'192 bytes
First seen:2026-07-07 14:56:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'197 x AgentTesla, 20'355 x Formbook, 12'365 x SnakeKeylogger)
ssdeep 12288:+4MHR8apymNflGTPzg8Mt7wwvajNpfNhagcknR750QhMdCxuXiddDkSY2:oVNflAPWBwwSjb2gcknh50Qid24sISV
Threatray 719 similar samples on MalwareBazaar
TLSH T1F3F402942319D70BEA5563B44972F27107B83E9EB512E20A4FD9BDEF7926F404E10393
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/bf351735-9f36-49ed-88f0-5093ea987fbe/
Malware family:
n/a
ID:
1
File name:
691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520.exe
Verdict:
Malicious activity
Analysis date:
2026-07-08 14:08:37 UTC
Tags:
xworm remote auto-startup auto-reg
Link:
https://app.any.run/tasks/66bc76be-3a56-44c2-bbc0-4ef02d0b6458

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/73617/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4e59e4a900f0e9eb6aa8f4
Tags:
autorun shell micro sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Creating a process with a hidden window
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed vbnet
Link:
https://www.filescan.io/uploads/6a4d2258a151702f90049d57/reports/7d1a9c74-162c-456c-b15f-34832002a128/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-17T07:30:00Z UTC
Last seen:
2026-06-25T01:21:00Z UTC
Hits:
~100
Detections:
Backdoor.Agent.TCP.C&C Trojan.MSIL.Inject.sb Backdoor.MSIL.XWorm.c Backdoor.MSIL.XWorm.b PDM:Trojan.Win32.Tasker.cust PDM:Trojan.Win32.Generic Trojan.Win32.Agent.sb Trojan.MSIL.Crypt.sb HEUR:Trojan-Spy.MSIL.Noon.gen
Link:
https://opentip.kaspersky.com/691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520/results?tab=lookup
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0dc73b35-63a0-4838-ab9e-f90d2d783f64
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2026-06-17 12:54:53 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nejcfngdry4dnfwlldc7gvmrq3cozzykfrqscsqsn3wb34jv2uqa._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
AsyncRAT
aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d
AsyncRAT
c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9
AsyncRAT
c9e92d24fefd87f1817428ceb56e175ddcf19ecd96d80418824a553588aa6067
AsyncRAT
+ 709 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm adware discovery execution persistence rat spyware trojan
Link:
https://tria.ge/reports/260707-s8v9hsgy3t/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
Enumerates connected drives
Checks computer location settings
Drops startup file
Executes dropped EXE
Boot or Logon Autostart Execution: Active Setup
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
109.248.150.234:443
Unpacked files
SH256 hash:
691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
MD5 hash:
7051fba1656e9cb1114fa39804c5cb91
SHA1 hash:
c98556c2b239d8ab55658fe97f212640bf98cbef
Link:
https://www.unpac.me/results/0f9e31de-72e8-4346-bfac-94fa270c0f92/
SH256 hash:
17f08a6524850356522e1cf34b1d40ac71e79311612d7f5c2c6be840c35b6c16
MD5 hash:
37a16a468be2ff4f499c47c53e8d40b8
SHA1 hash:
18338aeaa2f4e4571bdcd31341d2ac65dbd954e1
Link:
https://www.unpac.me/results/0f9e31de-72e8-4346-bfac-94fa270c0f92/
SH256 hash:
f9183d461a9ef71e1a0a97ddef54f5a785c3d4fa1ac6cb979a82206a52037928
MD5 hash:
ef3e974cb8bc7d3ab1ad98f55b7ba7c3
SHA1 hash:
7466eb7f8f9b5b57bb28e1d0493c390aba833da9
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
Link:
https://www.unpac.me/results/0f9e31de-72e8-4346-bfac-94fa270c0f92/
Parent samples :
c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9
70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9
7776706d26fb2dfd7cb96910810bb4c3a02b343a228035a0ca4db3ccf8e4d26a
37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b
691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
24d5fc96c725a959f62d8bbe6559e58cd3b2cef13c682cc38398c14446690275
713a11326d11d660cca496d6a944416e9b990eddb9156f8435dbec0a91bf56d5
1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a
c72a16f9d18a75f9ccc80bb1a3550e147c19a079700b1a7bfc752907656b06cf
d7beff6c8488d84321d9e1995da87e55c13fcd4b45b2e4e1e96cda5a82691c9e
d7adcdad2dc0743c188db7314028ce74827a81fc3eee6b38bf9d0e9f57c7f222
d073fb2faae776d80e0cf2c5720da618295daca356a706382c02fb64f4b838ba
SH256 hash:
32b8e690fb1d6af88669da130c734c70a8d2bf3f17064e546c797a093dc260cf
MD5 hash:
341300429d1454204733b59ae1b149f7
SHA1 hash:
8b3bee20f2c274731d03474a4f9ae729fbd6049b
Link:
https://www.unpac.me/results/0f9e31de-72e8-4346-bfac-94fa270c0f92/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/691222b4c38e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73617/

Comments