MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 6 File information Comments

SHA256 hash:	6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b
SHA3-384 hash:	ccdeaf6dba010333a305df7288fb3973490129968e91697da3c0d15da83f0a4247f6642fa6fdd3fdeb3088e38cfabff9
SHA1 hash:	c9cb39e535997ca9e45452a405e502351abecdb3
MD5 hash:	e9246ea292c91d357da0cca690557d9a
humanhash:	cardinal-november-uncle-virginia
File name:	file
Download:	download sample
File size:	319'488 bytes
First seen:	2025-12-03 22:48:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a677bc652bfc65ccd5c99d014a2803ce
ssdeep	6144:bm3oREPNNoW/eLBB20s/S1h8MQdSHThbhzb:lRE3orLD2HSX3ESHThbh
TLSH	T126648D5AB7B410FDE177C278C8520506EB76FC56876196CF03A44AA71F236E09E3EB12
TrID	48.7% (.EXE) Win64 Executable (generic) (10522/11/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 727ef8598990483205600a38a67ccebea5d9926b9f8312fffaf4e72c6990a933

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	131'072 bytes
File size (de-compressed) :	319'488 bytes
Format:	win64/pe
Packed file:	727ef8598990483205600a38a67ccebea5d9926b9f8312fffaf4e72c6990a933

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

asyncrat

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2025-12-03 22:50:54 UTC

Tags:

auto-sch auto-reg asyncrat

Link:

https://app.any.run/tasks/aecbf79a-0572-4a3d-8d8b-fc55b66b5b2c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/42385/

Detection(s):

ditekSHen.MALWARE.Win.Trojan.AsyncRAT.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6930be6f264b106bd646b9a2

Tags:

asyncrat autorun

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a process with a hidden window

DNS request

Connection attempt

Sending a custom TCP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm explorer fingerprint lolbin microsoft_visual_cc schtasks

Link:

https://www.filescan.io/uploads/6930be6bff25e40750d294fc/reports/62451450-2c5d-42a9-b288-ae107953044f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b

Result

Gathering data

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/e9246ea292c91d357da0cca690557d9a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b/

Verdict:

Malicious

Threat:

Family.ASYNCRAT

Link:

https://tip.neiki.dev/file/6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nsxorpvxh53evkmdqrzuzux6ei2bjds6r5fcz7dla2bspwvspivq._file

Result

Malware family:

n/a

Score:

6/10

Tags:

execution persistence

Link:

https://tria.ge/reports/251203-2rslqshn3w/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Adds Run key to start application

Unpacked files

SH256 hash:

6caee8beb73f764aa98384734cd2fe2234148e5e8f4a2cfc6b068327dab27a2b

MD5 hash:

e9246ea292c91d357da0cca690557d9a

SHA1 hash:

c9cb39e535997ca9e45452a405e502351abecdb3

Link:

https://www.unpac.me/results/fbf4fd3c-0614-4fbc-ad3e-fa4fab273601/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)