🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10
SHA3-384 hash: 144b7573b5816a5ab378b97dc963a551ef41b97dff01802c3ec3c3be14643c1a4847fc3eb2dbed45686d9c4da509ab6a
SHA1 hash: 2c8970ff883b7189ba93b5aa3420d704c62fd6ef
MD5 hash: 883aa80382ca517480f5e1c9df4c35ff
humanhash: foxtrot-eight-indigo-steak
File name:DHK9876543456780.js
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:2'892'193 bytes
First seen:2026-10-16 10:20:18 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 49152:PxJ/0QwdkHkQvv23WMKDcLknA1u5YJcmdTg846HjsfSACFP8Wb0FikgYt1BxkRUr:PxJ/0QwdkHkQX23WMKDcLkA1u52caTgR
TLSH T192D5A52FEA304E5934D91ECC7D53C1E8CBDFB6A4C948BECB7952A9529B240E189D4370
Magika c
Reporter threatcat_ch
Tags:AsyncRAT js

Intelligence

File Origin
# of uploads :
1
# of downloads :
513
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.GT.JS.IcedId.1.2293C2A3.62829182.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad1fa84f4e17c78f7162a5b
Tags:
autorun autoit emotet
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug autoit cmd dropper evasive expired-cert fingerprint keylogger lolbin obfuscated packed persistence reconnaissance repaired schtasks wscript
Link:
https://www.filescan.io/uploads/6ad1fa75b6b2c30728a7f7f5/reports/60b2ce16-7673-49e4-8deb-132c5a3dd369/overview
Verdict:
Malicious
Labled as:
GT:JS.IcedId.1
Link:
https://www.hybrid-analysis.com/sample/843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10
Verdict:
Malicious
File Type:
js
First seen:
2026-10-16T03:02:00Z UTC
Last seen:
2026-10-18T08:41:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10/results?tab=lookup
Result
Threat name:
XWorm
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1987981
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Detected Windows Script Host debugger hammering
Found malware configuration
Injects a PE file into a foreign processes
JavaScript file contains suspicious strings
JScript performs obfuscated calls to suspicious functions
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses string decryption to hide its real strings
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Yara detected AntiVM3
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1987981 Sample: DHK9876543456780.js Startdate: 16/10/2026 Architecture: WINDOWS Score: 100 85 www.google.com 2->85 87 mr-b01.tm-azurefd.net 2->87 89 5 other IPs or domains 2->89 115 Suricata IDS alerts for network traffic 2->115 117 Found malware configuration 2->117 119 Malicious sample detected (through community Yara rule) 2->119 121 11 other signatures 2->121 10 wscript.exe 2 12 2->10         started        14 wscript.exe 9 2->14         started        signatures3 process4 file5 67 C:\ProgramData\...\vcruntime140.dll, PE32 10->67 dropped 69 C:\ProgramData\...69SXEMCYATANPLYFZUKB.exe, PE32 10->69 dropped 71 C:\ProgramData\...\WindowsSecurityUpdate.js, Unicode 10->71 dropped 81 2 other malicious files 10->81 dropped 133 Benign windows process drops PE files 10->133 135 JScript performs obfuscated calls to suspicious functions 10->135 137 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->137 139 Detected Windows Script Host debugger hammering 10->139 16 NSXEMCYATANPLYFZUKB.exe 10->16         started        19 cmd.exe 1 10->19         started        73 C:\ProgramData\...\vcruntime140.dll, PE32 14->73 dropped 75 C:\ProgramData\...\PDHGBYCOVLXFPNX.exe, PE32 14->75 dropped 77 C:\ProgramData\...\PDHGBYCOVLXFPNX.zip, Zip 14->77 dropped 79 C:\ProgramData\...\PDHGBYCOVLXFPNX.ini, Unicode 14->79 dropped 141 WScript reads language and country specific registry keys (likely country aware script) 14->141 21 PDHGBYCOVLXFPNX.exe 14->21         started        23 cmd.exe 14->23         started        signatures6 process7 signatures8 105 Writes to foreign memory regions 16->105 107 Allocates memory in foreign processes 16->107 109 Injects a PE file into a foreign processes 16->109 25 MSBuild.exe 2 4 16->25         started        111 Uses schtasks.exe or at.exe to add and modify task schedules 19->111 29 schtasks.exe 1 19->29         started        31 conhost.exe 19->31         started        113 Uses ping.exe to check the status of other devices and networks 21->113 33 PING.EXE 12 21->33         started        35 conhost.exe 23->35         started        37 schtasks.exe 1 23->37         started        process9 dnsIp10 91 209.54.102.133, 4445, 49913 AS-COLOCROSSING-HostPapaUS United States 25->91 125 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 25->125 127 Tries to steal Mail credentials (via file / registry access) 25->127 129 Tries to harvest and steal browser information (history, passwords, etc) 25->129 131 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 25->131 39 MSBuild.exe 25->39         started        42 csc.exe 25->42         started        45 csc.exe 25->45         started        52 2 other processes 25->52 47 chrome.exe 3 33->47         started        50 chrome.exe 33->50         started        signatures11 process12 dnsIp13 123 Antivirus detection for dropped file 39->123 83 C:\Users\user\AppData\Local\...\MSBuild.exe, PE32 42->83 dropped 54 conhost.exe 42->54         started        56 cvtres.exe 42->56         started        58 conhost.exe 45->58         started        60 cvtres.exe 45->60         started        99 192.168.11.20, 443, 4445, 49871 unknown unknown 47->99 101 192.168.11.30 unknown unknown 47->101 62 chrome.exe 47->62         started        65 chrome.exe 47->65         started        103 mr-b01.tm-azurefd.net 150.171.110.18 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 52->103 file14 signatures15 process16 dnsIp17 93 mr-z01.tm-azurefd.net 150.171.109.69, 443, 49926 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 62->93 95 mr-azurefd.tm-azurefd.net 150.171.110.19, 443, 49920 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 62->95 97 13 other IPs or domains 62->97
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10/
Threat name:
Script-JS.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-10-16 09:08:27 UTC
File Type:
Text (JavaScript)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qq6nv475etcmej7tpmfmlxdj5ztoa2z6grwliw4zyen27aodniia._file
Verdict:
malicious
Label(s):
XWorm
Create hunting rule
Link:
https://reports.threatray.com/c9e6a41b-2d53-49f8-8745-f03aa3411b05
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm collection defense_evasion discovery execution persistence ransomware rat spyware stealer trojan
Link:
https://tria.ge/reports/261016-mdafnsc191/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
outlook_office_path
outlook_win_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Enumerates video capture drivers
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
System Binary Proxy Execution: Regsvcs/Regasm
Detect Xworm Payload
Family: Xworm
Malware Config
C2 Extraction:
209.54.102.133:4445
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:MAL_AsyncRAT_Family_V_0_5_8
Create hunting rule
Author:Trezzza
Description:Detects AsyncRAT version 0.5.8 and some other versions of AsyncRAT. The name reflects the analysed sample.
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:rat_win_xworm_v3
Create hunting rule
Author:Sekoia.io
Description:Finds XWorm (version XClient, v3) samples based on characteristic strings
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

Java Script (JS) js 843cdaf3fd24c4c227f37b0ac5dc69ee66e06b3e346cb45b99c11baf81c36a10

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments