🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 19


Intelligence 19 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
SHA3-384 hash: aa2daede732b16854a5777b3b045e72aef7406f5c2d58834cc0147a5f464289cf1c8d31b3138261b836308db6b913a4e
SHA1 hash: 53b4f3493184045d5bbff9de6b8a94b150c6e0e9
MD5 hash: f3f5b3f73221c983693a4658a8875fc1
humanhash: kansas-foxtrot-foxtrot-purple
File name:Borclusu_Olunan_Cekler_Gunbasi_25.06.2026.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:752'640 bytes
First seen:2026-06-25 10:51:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'246 x AgentTesla, 20'509 x Formbook, 12'377 x SnakeKeylogger)
ssdeep 12288:D2LxnupjXgxUf1sOhbrotlBIeSYsJd3Q8mClXi2zGF9fiRWl:D8IjY0otpSY+d3Mr2zGDqR
Threatray 19 similar samples on MalwareBazaar
TLSH T10DF40228042BC40AE9F56EB11C71F1F5A7B73D9AB238D0296FC64D6F72636087D89325
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 02bea086b0a49e86 (1 x PhantomStealer, 1 x AsyncRAT, 1 x RemcosRAT)
Reporter lowmal3
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
308
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/189269b9-8a81-463a-bd60-7b27c74ab8fc/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-06-25 10:53:32 UTC
Tags:
auto-reg auto-startup xworm remote stealer
Link:
https://app.any.run/tasks/52a79fff-e354-45cd-90b6-16cdebc00f0c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/71922/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.74192554.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
N/A%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a3d08431548daf709f9aea3
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Creating a process with a hidden window
Launching a process
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6a3d083c9799578a6c4b4df0/reports/c0487480-556e-4351-9aea-6244e175f386/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-06-25T02:52:00Z UTC
Last seen:
2026-06-27T07:00:00Z UTC
Hits:
~100
Detections:
PDM:Trojan.Win32.Generic Backdoor.MSIL.XWorm.a Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Backdoor.MSIL.XWorm.c PDM:Trojan.Win32.Tasker.cust HEUR:Trojan.MSIL.Crypt.gen Backdoor.Agent.TCP.C&C Trojan.MSIL.Crypt.sb Backdoor.MSIL.XWorm.b
Link:
https://opentip.kaspersky.com/70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7/results?tab=lookup
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d7fe90e6-efc8-46d2-91c8-4f3857ba8bdd
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1933635
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1933635 Sample: Borclusu_Olunan_Cekler_Gunb... Startdate: 25/06/2026 Architecture: WINDOWS Score: 100 75 keyauth.win 2->75 79 Suricata IDS alerts for network traffic 2->79 81 Found malware configuration 2->81 83 Malicious sample detected (through community Yara rule) 2->83 85 10 other signatures 2->85 9 Borclusu_Olunan_Cekler_Gunbasi_25.06.2026.exe 3 2->9         started        13 bin.exe 2->13         started        15 bin.exe 2->15         started        17 10 other processes 2->17 signatures3 process4 dnsIp5 63 Borclusu_Olunan_Ce..._25.06.2026.exe.log, ASCII 9->63 dropped 95 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->95 97 Bypasses PowerShell execution policy 9->97 99 Uses schtasks.exe or at.exe to add and modify task schedules 9->99 105 3 other signatures 9->105 20 Borclusu_Olunan_Cekler_Gunbasi_25.06.2026.exe 2 6 9->20         started        101 Multi AV Scanner detection for dropped file 13->101 103 Injects a PE file into a foreign processes 13->103 25 bin.exe 13->25         started        27 bin.exe 15->27         started        73 127.0.0.1 unknown unknown 17->73 65 C:\Windows\Temp\yd5rj43t.inf, Windows 17->65 dropped 67 C:\Windows\Temp\yavshwx0.inf, Windows 17->67 dropped 69 C:\Windows\Temp\40a1ulgo.inf, Windows 17->69 dropped 29 cmstp.exe 17->29         started        31 cmstp.exe 17->31         started        33 conhost.exe 17->33         started        35 5 other processes 17->35 file6 signatures7 process8 dnsIp9 77 109.248.150.234, 443, 49694 DATACLUB-NLLV Netherlands 20->77 61 C:\Users\user\AppData\Roaming\bin.exe, PE32 20->61 dropped 91 Tries to harvest and steal browser information (history, passwords, etc) 20->91 93 Adds a directory exclusion to Windows Defender 20->93 37 powershell.exe 23 20->37         started        40 powershell.exe 23 20->40         started        42 powershell.exe 23 20->42         started        44 4 other processes 20->44 file10 signatures11 process12 file13 87 Loading BitLocker PowerShell Module 37->87 47 conhost.exe 37->47         started        49 conhost.exe 40->49         started        51 conhost.exe 42->51         started        71 Borclusu_Olunan_Ce...basi_25.06.2026.exe, PE32 44->71 dropped 89 Antivirus detection for dropped file 44->89 53 conhost.exe 44->53         started        55 conhost.exe 44->55         started        57 conhost.exe 44->57         started        59 cvtres.exe 44->59         started        signatures14 process15
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.29 Win 32 Exe x86
Link:
https://app.malva.re/file/f3f5b3f73221c983693a4658a8875fc1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-06-25 06:52:43 UTC
File Type:
PE (.Net Exe)
Extracted files:
7
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=odbp4j7wpvn5ixyyzatkdxa7qux2q2zn5atrcunhxdcnnvmpgtlq._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
030967003eace6864210b5ac969bd55e91eda783aa60869fe6ff6dae00ee9c96
AsyncRAT
0bb63b72fee6437616c2df663e3248ac08ac971ef76d7dfaa6335bc33dde46f0
AsyncRAT
225e7d743bf14377c227a86d580e579f66d5d3fce26787c3a1a5677f27698d96
AsyncRAT
67e7b0bf057c8c7ef117be16a168833235920d0af16921ff59d0866f0d05e050
AsyncRAT
70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
AsyncRAT
a65c6f7e36a274402a40b3dd676d50ed00505bc7e7c1ec34faf1c88bee76c990
AsyncRAT
dbbb1c1ad17996d18e3e28537e0188b204657e87b8cb495e05bdb36c75cae466
AsyncRAT
ea84300a2c8500206df527ef2d2559a328e9b3efd41717c1a4d3e865d602c316
AsyncRAT
error
AsyncRAT
+ 9 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection discovery execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/260625-mzsjdaaz9x/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
109.248.150.234:443
Unpacked files
SH256 hash:
70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
MD5 hash:
f3f5b3f73221c983693a4658a8875fc1
SHA1 hash:
53b4f3493184045d5bbff9de6b8a94b150c6e0e9
Link:
https://www.unpac.me/results/2bc5dec0-6e54-45ce-b006-a53150009705/
SH256 hash:
f9183d461a9ef71e1a0a97ddef54f5a785c3d4fa1ac6cb979a82206a52037928
MD5 hash:
ef3e974cb8bc7d3ab1ad98f55b7ba7c3
SHA1 hash:
7466eb7f8f9b5b57bb28e1d0493c390aba833da9
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
Link:
https://www.unpac.me/results/2bc5dec0-6e54-45ce-b006-a53150009705/
Parent samples :
c8c385c10b1586728318f43b9dcafecfd46d8d6000984fe489bb1d219ea8b4f9
70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7
fe126b87922ff8049c4b19d6588324a3bb4874020b943e86de176445ebe7c7b9
7776706d26fb2dfd7cb96910810bb4c3a02b343a228035a0ca4db3ccf8e4d26a
37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b
691222b4c38e383696cb58c5f3559186c4ece70a2c61214a126eec1df135d520
24d5fc96c725a959f62d8bbe6559e58cd3b2cef13c682cc38398c14446690275
713a11326d11d660cca496d6a944416e9b990eddb9156f8435dbec0a91bf56d5
1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a
c72a16f9d18a75f9ccc80bb1a3550e147c19a079700b1a7bfc752907656b06cf
d7beff6c8488d84321d9e1995da87e55c13fcd4b45b2e4e1e96cda5a82691c9e
d7adcdad2dc0743c188db7314028ce74827a81fc3eee6b38bf9d0e9f57c7f222
d073fb2faae776d80e0cf2c5720da618295daca356a706382c02fb64f4b838ba
SH256 hash:
05ed4262c5a0718cc4b3a9e15484d58504caf938127b2a75395a578870db6977
MD5 hash:
6b875a912accd3140b5c6370fafaa870
SHA1 hash:
7d410c8bc03a9b91eb9f539e694d6a8f902767fb
Link:
https://www.unpac.me/results/2bc5dec0-6e54-45ce-b006-a53150009705/
SH256 hash:
cb6f45003cc1e1547e8e377bdd8e9a15445119e9b610969d7b857e84722e1d59
MD5 hash:
53c39f839fd2efff0cea32307cecdd1c
SHA1 hash:
e82ba130e7e3a772086955784054c060cc1962d6
Link:
https://www.unpac.me/results/2bc5dec0-6e54-45ce-b006-a53150009705/
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/70c2fe27f67d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AsyncRAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

Executable exe 70c2fe27f67d5bd45f18c826a1dc1f852fa86b2de8271151a7b8c4d6d58f34d7

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/71922/

Comments