MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
SHA3-384 hash: f192580ab85e311d5ed56d1d70187403e9051e3aa73324c21ae77b88352ce910c0d511d693dbcfdb181d9d0cd8fe69f2
SHA1 hash: 51e517e785d6902015cdb22e280816aa4e5c9b64
MD5 hash: 019e2908e6762b84d64475b84f7ac951
humanhash: mockingbird-freddie-cold-monkey
File name:Transferencia emitida a su favor.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:892'928 bytes
First seen:2025-07-03 08:56:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep 12288:7jXHQpnCFFdVXUjmsnAxuv9eE8fsYyY25BkL9+Dwk7yGnSk:70WbaCgvyfsYwRnnz
Threatray 6 similar samples on MalwareBazaar
TLSH T1D9159DA833495D81D03C77399973375087F2B9DBE8BA831A56CCA2DEB5227D02D9170B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter lowmal3
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
28
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rl_85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
Verdict:
Suspicious activity
Analysis date:
2025-07-03 09:12:05 UTC
Tags:
netreactor auto-reg
Link:
https://app.any.run/tasks/44544d23-0e1d-45aa-9e8d-c3a86cc1e5dc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/12116/
Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686645f4c9eb97473765cb78
Tags:
dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Creating a process from a recently created file
Forced shutdown of a system process
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 findstr fingerprint lolbin obfuscated obfuscated reconnaissance vbnet
Link:
https://www.filescan.io/uploads/686645f37423ff017c3e2389/reports/64275b50-447e-44e2-b9eb-b9b834d44b42/overview
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/142f68c1-ae8a-445d-845f-3be9f6ce1416
Result
Threat name:
AsyncRAT, DarkTortilla, PureLog Stealer,
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1727861
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected AsyncRAT
Yara detected DarkTortilla Crypter
Yara detected PureLog Stealer
Yara detected VenomRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1727861 Sample: Transferencia emitida a su ... Startdate: 03/07/2025 Architecture: WINDOWS Score: 100 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 14 other signatures 2->50 9 Transferencia emitida a su favor.exe 3 2->9         started        13 Excel.exe 3 2->13         started        process3 file4 38 Transferencia emitida a su favor.exe.log, ASCII 9->38 dropped 54 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 9->54 56 Writes to foreign memory regions 9->56 58 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->58 60 Injects a PE file into a foreign processes 9->60 15 InstallUtil.exe 9 9->15         started        62 Document exploit detected (process start blacklist hit) 13->62 19 conhost.exe 13->19         started        signatures5 process6 file7 40 C:\Users\user\AppData\Roamingxcel.exe, PE32 15->40 dropped 42 Protects its processes via BreakOnTermination flag 15->42 21 cmd.exe 1 15->21         started        24 cmd.exe 1 15->24         started        signatures8 process9 signatures10 52 Uses schtasks.exe or at.exe to add and modify task schedules 21->52 26 conhost.exe 21->26         started        28 schtasks.exe 1 21->28         started        30 Excel.exe 3 24->30         started        32 conhost.exe 24->32         started        34 timeout.exe 1 24->34         started        process11 process12 36 conhost.exe 30->36         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/019e2908e6762b84d64475b84f7ac951
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344/
Verdict:
Malicious
Threat:
Win32.Trojan.DarkTortilla
Link:
https://tip.neiki.dev/file/85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
Threat name:
Win32.Trojan.DarkTortilla
Create hunting rule
Status:
Malicious
First seen:
2025-07-02 18:40:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvujxxoub56z2jqiulfgk23uomnbyphb4hibduuxweqriuqxqnca._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
6ff96de44e65161cfb8afd5e46e30b4940be0187b0c5422ff270f4e5adfb60a7
AsyncRAT
85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
AsyncRAT
97efe91fe5eff3dcdcb055f037f1df01c1409e6bd38a8f07170ea53a0ff265ef
AsyncRAT
eb1a02ec53eba0ce4ae75d74d6dff37d4e920390d8bd4f6e525761cb52208a22
AsyncRAT
error
AsyncRAT
Result
Malware family:
darktortilla
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:darktortilla botnet:ob-n crypter discovery loader rat
Link:
https://tria.ge/reports/250703-kwrfssdp9w/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Delays execution with timeout.exe
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
AsyncRat
Asyncrat family
Darktortilla
Darktortilla family
Detects Darktortilla crypter.
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1102642c-924b-4547-a546-15a3fd3de3e2
Unpacked files
SH256 hash:
85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
MD5 hash:
019e2908e6762b84d64475b84f7ac951
SHA1 hash:
51e517e785d6902015cdb22e280816aa4e5c9b64
Link:
https://www.unpac.me/results/af3a9377-4acb-4de5-99a8-c57040340ba5/
SH256 hash:
60e51cf895e480898440f6c97c6b4dff7e491c5180d56418c54be209bb84cdd9
MD5 hash:
b91e939c9ee8838508462a61e5abacb9
SHA1 hash:
2b541d7e7f087cdc1fa4ec95d656b74fe55944aa
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/af3a9377-4acb-4de5-99a8-c57040340ba5/
Parent samples :
eb1a02ec53eba0ce4ae75d74d6dff37d4e920390d8bd4f6e525761cb52208a22
85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344
8dbda1e5f543feb8eb36c4a15d3bde7bcb18524713fd21d5560a23f5965dbaee
6e24d211ffbc893adfc360912b9bd2b4c1ae1ef630a2ee030d58878a130b7d66
7d209386ac121c6b641c2ad2062b62cf667c179f6d6132b0f74fb1308928734e
SH256 hash:
452d90b4caf8e20fe0357f8f58df9c8b1357945ba57508b7c51dac654e19487a
MD5 hash:
cd4990885582f22208d40c3d7abdd294
SHA1 hash:
44abadcd7bc739a632bde445dc236d588e113074
Detections:
AsyncRAT
Create hunting rule
VenomRat
Create hunting rule
win_asyncrat_unobfuscated
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
Create hunting rule
Link:
https://www.unpac.me/results/af3a9377-4acb-4de5-99a8-c57040340ba5/
SH256 hash:
da4cb91d96214c7134a9e8799fdf241bd6b8103eecd4efb1b8c228ca3c8e7e91
MD5 hash:
9a06e083cd0531927dcd616b9b601ffa
SHA1 hash:
9584f7e1c8ab7be5900762abcaedf20cb92e4ae7
Link:
https://www.unpac.me/results/af3a9377-4acb-4de5-99a8-c57040340ba5/
SH256 hash:
2cb5b8fbcd0994c8371837858c1f6dfe8e0de017e86437c7aee38d710209f10a
MD5 hash:
4f5880d558000b383fbb6efb21100997
SHA1 hash:
d2ceb9140d797b0f4db46a0a02c274e4fe89f349
Link:
https://www.unpac.me/results/af3a9377-4acb-4de5-99a8-c57040340ba5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

Executable exe 85689bddd40f7d9d2608a2ca656b74731a1c3ce1e1d011d297b1211452178344

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12116/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high

Comments