MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 9

Intelligence 9 IOCs 1 YARA 26 File information Comments

SHA256 hash:	79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e
SHA3-384 hash:	c8c0750ea6d5ac58dbd15774fbd02b43fc58c02f09186a6abd69f0772a00f6687fb87977dba128f92e3a2f869444c1e1
SHA1 hash:	af015f1ef52a6b0ed9d5ccfd6806256ee89a2699
MD5 hash:	279da8d1118c1dd0988c8d1601d6998f
humanhash:	eleven-september-music-louisiana
File name:	AVISO DE CHEGADA - LRAN16014S.pdf.lzh
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	451'930 bytes
First seen:	2025-10-27 19:32:32 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:xngqi6UDA98qhd3z98Fn3hj0d0Z76FAauo53tqf:eqijG8qrD23hX56Fruo7I
TLSH	T1D7A42334DF91633C94BEB87CCE524047A35281E75E66D6E572A39BB73B7710312618D0
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	AsyncRAT lzh rar

cocaman

Malicious email (T1566.001)
From: "Nuyen Thanh Tuyen <nttuyen@safi.com.vn>" (likely spoofed)
Received: "from safi.com.vn (unknown [216.9.226.154]) "
Date: "22 Oct 2025 08:13:47 -0700"
Subject: "RE: AVISO DE CHEGADA - LRAN16014S - ANOVA TRADE CORPORATION"
Attachment: "AVISO DE CHEGADA - LRAN16014S.pdf.lzh"

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
216.9.224.196:2233	https://threatfox.abuse.ch/ioc/1613283/

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	AVISO DE CHEGADA - LRAN16014S.pdf.exe
File size:	980'480 bytes
SHA256 hash:	4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae
MD5 hash:	0209e6d12d95353e0cf11bf7477d1b52
MIME type:	application/x-dosexec
Signature	AsyncRAT

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ffc8e25de5ca270752fa9a

Tags:

underscore autorun autoit emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug autoit cmdkey compiled-script control evasive fingerprint formbook keylogger lolbin masquerade microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/68ffc91eacdc0d13837f40cb/reports/5d9fdda6-ebb1-4533-a360-7b3b441a5c0c/overview

Verdict:

Malicious

Labled as:

Trojan.Downloader

Link:

https://www.hybrid-analysis.com/sample/79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e

Verdict:

Malicious

File Type:

rar

First seen:

2025-10-23T10:23:00Z UTC

Last seen:

2025-10-23T11:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e/results?tab=lookup

Verdict:

Malware

YARA:

1 match(es)

Tags:

AutoIt Decompiled Executable PDB Path PE (Portable Executable) PE File Layout Rar Archive Suspect

Link:

https://app.malva.re/file/279da8d1118c1dd0988c8d1601d6998f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e/

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e

Threat name:

Script-AutoIt.Trojan.AutoitInject

Status:

Malicious

First seen:

2025-10-22 17:10:07 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=phl2q6tnjjdcamqmyulejwyqup3jdmhme764pmc3yw4r5x7nhbha._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	ByteCode_MSIL_Backdoor_AsyncRAT Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects AsyncRAT backdoor.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	MALWARE_Win_AsyncRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AsyncRAT

Rule name:	MALWARE_Win_XWorm Create hunting rule
Author:	ditekSHen
Description:	Detects XWorm

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Njrat Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_DOTNET_PE_List_AV Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detecs .NET Binary that lists installed AVs

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	Windows_Trojan_XWorm_b7d6eaa8 Create hunting rule
Author:	Elastic Security

Rule name:	win_xworm_bytestring Create hunting rule
Author:	Matthew @ Embee_Research
Description:	Detects bytestring present in unobfuscated xworm

Rule name:	win_xworm_w0 Create hunting rule
Author:	jeFF0Falltrades
Description:	Detects win.xworm.

Rule name:	xworm Create hunting rule
Author:	jeFF0Falltrades

Rule name:	xworm_kingrat Create hunting rule
Author:	jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

rar 79d7a87a6d4a4620320cc51644db10a3f691b0ec27fdc7b05bc5b91edfed384e

(this sample)

AsyncRAT

exe 4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae

Delivery method

Distributed via e-mail attachment

Dropping

SHA256 4871c9614e5fc83321aa6b273fd3a9a28a8a5fd21685a1b4d76d3491b470d8ae

Dropping

AsyncRAT

Dropping

MD5 0209e6d12d95353e0cf11bf7477d1b52

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample