MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3
SHA3-384 hash: 5efb2d6f3aa2c094f3628209fc109f4428eb97c9ff234a573185dc022ac9c7f473d900072ac1c2de17cb0145cd7ba681
SHA1 hash: 8145e319f133f9fa7f958903a93ad9495aec9272
MD5 hash: 9eb53d84d13d6d83a963b77eb484b6be
humanhash: idaho-high-bacon-virginia
File name:6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:866'304 bytes
First seen:2026-06-08 09:34:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'066 x AgentTesla, 20'010 x Formbook, 12'352 x SnakeKeylogger)
ssdeep 12288:NABp1ZIrKyVVon0kLVaQBnrbWKtPQ2tl+6A0Sm2NaF7MnB/BNaj6XU:aB1IonxVasfJFu6eNCs3au
TLSH T1560501887665D40BC66993B44470F5B853B91EAEB811C7868FE9ADEFB5FAF048D00343
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon c170cce0f0e0f10c (5 x Formbook, 2 x AsyncRAT, 2 x MassLogger)
Reporter adrian__luca
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/81444ddb-af13-4e66-9f00-912d75fad860/
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/69834/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a268dceae2f98c00a68c938
Tags:
autorun virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Creating a file in the %AppData% directory
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypt packed vbnet
Link:
https://www.filescan.io/uploads/6a268dad8161ac6cb55cab57/reports/5bf54f79-ec0f-46a4-bfc1-5e799fc1bf10/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-12T03:00:00Z UTC
Last seen:
2026-06-08T02:42:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/43330194-3cee-4f85-a162-337f6be2815c
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3/
Threat name:
ByteCode-MSIL.Trojan.PurelogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-05-12 05:58:53 UTC
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
error
AsyncRAT
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery rat trojan
Link:
https://tria.ge/reports/260608-llzvvsbv8q/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Drops startup file
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
172.94.15.100:6070
Unpacked files
SH256 hash:
6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3
MD5 hash:
9eb53d84d13d6d83a963b77eb484b6be
SHA1 hash:
8145e319f133f9fa7f958903a93ad9495aec9272
Link:
https://www.unpac.me/results/bba22007-054a-4d8e-9241-d38129a1a31f/
SH256 hash:
3c530d861e476f78bc490dcf9c64c8f55bd4979b1359714ec6c6d3c078c8bd64
MD5 hash:
e651b468def94d3040836dd7904f91be
SHA1 hash:
226f698bfbdce1eeae2542ecfd380daa8b52a3b5
Link:
https://www.unpac.me/results/bba22007-054a-4d8e-9241-d38129a1a31f/
SH256 hash:
063ad4d36d685ea710038c154c29d75df4a582ffae18288690ff935f915e75b5
MD5 hash:
60b51e16c47b2d1f1db58804bc4b9d88
SHA1 hash:
58112fc5ca8bee58bb07281d601fd18bf7ef309d
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
Link:
https://www.unpac.me/results/bba22007-054a-4d8e-9241-d38129a1a31f/
Parent samples :
8a249e7566f513e34498a82593b400fe5d279ee7687cc52b4a8a709b88d77313
dafff5dbcd0d96094d6513e8dd738e9029fbde862d04c78a5688df0afb4b1c90
6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3
SH256 hash:
bae5988fa2f1d7b67351eb16cacddafe2f3b01a166cbc941efb32edf4137d428
MD5 hash:
d3b0e5cb753aa9d22ed03d0c60e85ae6
SHA1 hash:
bec6532184a079946c01285dc4a997c52deb3011
Link:
https://www.unpac.me/results/bba22007-054a-4d8e-9241-d38129a1a31f/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/6f3f9135288d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69834/

Comments