MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 33 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00
SHA3-384 hash: 68d69ccff5e789199b109efa177b81ea6a0b7a39e49d548126cf13a4d971b9aa555b025a7c4afda0170b61ab86885e22
SHA1 hash: 4a75efd8cafdee49709319a994ae763fc9199b1f
MD5 hash: e3f358daf88f5e2770f925a0667d65af
humanhash: november-edward-undress-charlie
File name:file
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:3'715'248 bytes
First seen:2026-01-12 13:06:23 UTC
Last seen:2026-01-27 17:14:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash efd455830ba918de67076b7c65d86586 (65 x Gh0stRAT, 19 x ValleyRAT, 6 x OffLoader)
ssdeep 98304:IxHXserC+JZ05Uz+qDF7ttR4YxxrY29L0DiKvC7o:wserpZ0525ttRpxr3F9KvC0
Threatray 36 similar samples on MalwareBazaar
TLSH T1B3060127B2CB653FF07E4A364977E212593BBA6169128C6697F4086CCF260D01E3F746
TrID 48.4% (.EXE) Inno Setup installer (107240/4/30)
19.4% (.EXE) InstallShield setup (43053/19/16)
18.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
4.7% (.EXE) Win64 Executable (generic) (10522/11/4)
2.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Magika pebin
Reporter Bitsight
Tags:AsyncRAT dropped-by-Stealc exe gfdhgcxww


Avatar
Bitsight
url: http://196.251.107.104/Polarised_97.74.8_INSTALL.exe

Intelligence

File Origin
# of uploads :
417
# of downloads :
185
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/62c983c3-7810-49df-81a5-b7959cb0b7e0/
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
Suspicious activity
Analysis date:
2026-01-12 13:10:04 UTC
Tags:
upx
Link:
https://app.any.run/tasks/1a5c93fc-4b95-4a37-9cdd-6dda7f9f4f4f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
AsyncRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/48610/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.15799885.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6964f1dfa3ed2a87ae3e93b7
Tags:
injection dropper
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint inno installer installer installer-heuristic overlay packed soft-404
Link:
https://www.filescan.io/uploads/6964f1d91a20a4c87b1b5bbc/reports/2cbdfb19-ff5c-4c9c-b4af-bd5af86610c6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-12T08:14:00Z UTC
Last seen:
2026-01-14T11:36:00Z UTC
Hits:
~1000
Detections:
Backdoor.MSIL.Agent.sb Trojan-PSW.Lumma.HTTP.C&C Trojan.Win32.Gatak.sb Backdoor.MSIL.Crysan.d Backdoor.MSIL.Crysan.b Trojan.Win32.RokRat.sb Backdoor.MSIL.Crysan.sb Backdoor.MSIL.Crysan.mjf Trojan-Downloader.Bazloader.HTTP.C&C Trojan.Win32.Mansabo.sb Trojan.Win32.AntiAV.sb Trojan.Gatak.TCP.C&C Backdoor.MSIL.Crysan.c Trojan-Spy.Agent.HTTP.C&C Trojan.Win32.Shellcode.sb Trojan.MSIL.Crypt.sb VHO:Backdoor.MSIL.Agent.gen
Link:
https://opentip.kaspersky.com/709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/00af2b44-0d52-4f0c-a472-00c4421c6185
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/e3f358daf88f5e2770f925a0667d65af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00/
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00
Threat name:
Win32.Backdoor.Asyncrat
Create hunting rule
Status:
Suspicious
First seen:
2026-01-12 11:26:15 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ocnda65ykcvx3hzne2jdddavssrhmowuuv3e2qvqpjrku3xuxuaa._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
0afa2d3579842ab2805c4f46a0d6401b8d0c48bf94df1b7573a5fcf20c7ef066
AsyncRAT
229aa8d7f88dce937a06c3d10e7ee1a719921c7d56a2d51788bf76520897ae70
AsyncRAT
4f3d469af5755c122b73cb0b03acee13ea08b4863621fc0ea121c049a05a8806
AsyncRAT
62773c9efb9000b1d4b3770b03ac0b283c3f36429049904e85ebddd3446928df
AsyncRAT
a734adc41b09e5bbd8488e86b7402f32d9b2bc618c25a2c55d2c8b80a542b66a
AsyncRAT
cbceaf45b5442e4693a1cb24116820a26dace4d23c348ba9539b1faa049f70a6
AsyncRAT
e04c0a63203c01287f3caeb0713dbdaf55cf31a3fbaf5fdefd9e1047beb9436b
AsyncRAT
e5bffd1dee2cab5893d916605ae2eb05b69610dfd424acc65fb6055c38ddb41e
AsyncRAT
error
AsyncRAT
+ 26 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:stealc family:svcstealer family:xworm botnet:crypt botnet:default defense_evasion discovery downloader execution installer persistence rat spyware stealer trojan upx
Link:
https://tria.ge/reports/260112-qcaltsas8a/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Inno Setup is an open-source installation builder for Windows applications.
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Command and Scripting Interpreter: PowerShell
Drops file in System32 directory
Suspicious use of SetThreadContext
UPX packed file
Accesses cryptocurrency files/wallets, possible credential harvesting
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Async RAT payload
AsyncRat
Asyncrat family
Detect Xworm Payload
Detects SvcStealer Payload
Stealc
Stealc family
SvcStealer, Diamotrix
Svcstealer family
Xworm
Xworm family
Malware Config
C2 Extraction:
196.251.107.104:6606
196.251.107.104:7707
196.251.107.104:8808
http://196.251.107.23
196.251.107.104:1177
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6dc7448d-4e46-4b38-92db-30f2e699f7cf
Unpacked files
SH256 hash:
709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00
MD5 hash:
e3f358daf88f5e2770f925a0667d65af
SHA1 hash:
4a75efd8cafdee49709319a994ae763fc9199b1f
Link:
https://www.unpac.me/results/b5e05fc5-a109-4671-9467-07680abc2c11/
SH256 hash:
ea8709d62032785f17e63231b01b1ce743448e0f81c7f7edc0883fedef97f28e
MD5 hash:
06bb252628db946d02b69653e39b8ec5
SHA1 hash:
e941ff960ec7f042974d42ab2ea2c6eca20ff9f9
Link:
https://www.unpac.me/results/b5e05fc5-a109-4671-9467-07680abc2c11/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/709a307bb850/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AsyncRat
Create hunting rule
Author:kevoreilly, JPCERT/CC Incident Response Group
Description:AsyncRat Payload
Rule name:asyncrat_kingrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:malware_asyncrat
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:MAL_packer_lb_was_detected
Create hunting rule
Author:0x0d4y
Description:Detect the packer used by Lockbit4.0
Rule name:Mal_WIN_AsyncRat_RAT_PE
Create hunting rule
Author:Phatcharadol Thangplub
Description:Use to detect AsyncRAT implant.
Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:UPXProtectorv10x2
Create hunting rule
Author:malware-lu
Rule name:Windows_Generic_Threat_c9003b7b
Create hunting rule
Author:Elastic Security
Rule name:Windows_Generic_Threat_ce98c4bc
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Asyncrat_11a11ba1
Create hunting rule
Author:Elastic Security
Rule name:win_asyncrat_bytecodes
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects bytecodes present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_unobfuscated
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe 709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00

(this sample)

  
Dropped by
StealC
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3756794/
Cape
Cape
https://www.capesandbox.com/analysis/48610/

Comments