MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
SHA3-384 hash: 4a1d61f839083246939ae5f7c810ea98f250d3cb8a2c64e3633c17db5463be14135d559ee2c43beab63798085030459a
SHA1 hash: ba4da717a43001f1bc14b204608749dd84d81e3c
MD5 hash: 1b7be3e24bef996b5e313aedf478815a
humanhash: lemon-romeo-red-fanta
File name:NOTEPAD.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:736'768 bytes
First seen:2026-02-02 18:25:06 UTC
Last seen:2026-02-02 19:48:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'754 x AgentTesla, 19'663 x Formbook, 12'252 x SnakeKeylogger)
ssdeep 12288:8vH4DGHYYNRHYLa9qMhHauEbJ4E4n2uXIIYzcdhaHJOfG:iHyGHYYNRHYm9Ph6WE4n54IwcdhCeG
Threatray 3 similar samples on MalwareBazaar
TLSH T1AAF4BD0223E69B24F8BF673986B1851087F9FD069236EB5E3B4B11F91F12B558952333
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter qemped
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
109
Origin country :
ID ID
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
NOTEPAD.exe
Verdict:
Malicious activity
Analysis date:
2026-02-02 18:42:43 UTC
Tags:
netreactor auto-startup xworm remote stealer auto generic auto-reg phantom evasion
Link:
https://app.any.run/tasks/dec14af5-7e84-46b7-8890-309d1838a0ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/51302/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6980ec32a9ffec4a9609626f
Tags:
virus micro
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Connection attempt to an infection source
Creating a file in the mass storage device
Query of malicious DNS domain
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices
Verdict:
Malicious
Labled as:
MSILHeracles.Generic
Link:
https://www.hybrid-analysis.com/sample/897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-31T18:18:00Z UTC
Last seen:
2026-02-03T05:14:00Z UTC
Hits:
~10
Detections:
Trojan-Spy.Agent.SMTP.C&C Email-Worm.LovGate.TCP.C&C Backdoor.Androm.HTTP.C&C Backdoor.Agent.TCP.C&C Trojan.MSIL.Inject.b HEUR:Backdoor.MSIL.XWorm.gen Backdoor.MSIL.XWorm.a PDM:Trojan.Win32.Generic Trojan.WinLNK.Agent.fb Trojan.MSIL.Inject.sb Trojan.MSIL.Agent.sb Backdoor.MSIL.XWorm.b HackTool.ReconScan.TCP.ServerRequest
Link:
https://opentip.kaspersky.com/897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc/results?tab=lookup
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3222bd75-b4dd-4cc6-a418-bbb4bc5cc4ab
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/1b7be3e24bef996b5e313aedf478815a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc/
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
Threat name:
Win32.Trojan.Jalapeno
Create hunting rule
Status:
Malicious
First seen:
2026-02-01 01:03:56 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rfzcd3335xkab7cf55hl3n3jy6mtqnuufz334xc4gruh5lzulp6a._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
af45e7ab9d8c10b174c3ae27c54f39e69311c1716be6af42cc50eaaf96e29710
AsyncRAT
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:phantom_stealer family:xworm collection discovery persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/260202-w2zj5sg13d/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Program Files directory
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Looks up external IP address via web service
.NET Reactor proctector
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads WinSCP keys stored on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Detect Xworm Payload
Detects PhantomStealer payload
PhantomStealer
Phantom_stealer family
Xworm
Xworm family
Malware Config
C2 Extraction:
rency.ydns.eu:59013
wqo9.firewall-gateway.de:59013
code1.ydns.eu:59013
Unpacked files
SH256 hash:
897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
MD5 hash:
1b7be3e24bef996b5e313aedf478815a
SHA1 hash:
ba4da717a43001f1bc14b204608749dd84d81e3c
Link:
https://www.unpac.me/results/121a0275-6c4b-4afd-854a-6a1b9de46f7c/
SH256 hash:
0ebdd6b8c242139f780a8b00abec958853237868b09de4bbf9dddc8b583da4f0
MD5 hash:
6e23b0cfefc115d31f8dac49b6379560
SHA1 hash:
234165f31d9f9d12dd286569f037fdf8fc42cfef
Link:
https://www.unpac.me/results/121a0275-6c4b-4afd-854a-6a1b9de46f7c/
SH256 hash:
e8fd2ba3e6973d83e9d47a8a3927720d985116237b19ab98224b8c53e0501d71
MD5 hash:
4f844017df3330ccb00c2e4e2de4503b
SHA1 hash:
2fb551286b524bb9adf217efcffaf47b8efb98bf
Link:
https://www.unpac.me/results/121a0275-6c4b-4afd-854a-6a1b9de46f7c/
SH256 hash:
fd7fb3258cf66e81004588e92d0716c2b958e11d58ec4cccdd34b707e2c629a5
MD5 hash:
c02c691102ab160e33c60e3309864755
SHA1 hash:
63d50f73a8c47fccdf27a076cb83ac4e4d90b45c
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/121a0275-6c4b-4afd-854a-6a1b9de46f7c/
Parent samples :
256b9eb0b0ef69eeee00712c0e9fab59601934633f2bb6d0a0b10ac04bd5b2ab
0e211c13ea627d3f7ae9023d2d7c1f972f56f8f0c0cd3cf3a52b2565d2e638ca
b6eb415d7b1be65850ede04ebe14006c319b11be80702c1d10ffd58a915a4f0f
b59f237069f8faccd2b47d23767c95ef269ea70bd910ad816728568afb9bec65
3ed85c60a5587bcf3c5c7cffd46c90491dfc3e3e74f91aac3f91c429a63c1792
67a9288baf5c274fae60465c54accb0973ea5e570c4eb992de3c5babc16b8dae
af45e7ab9d8c10b174c3ae27c54f39e69311c1716be6af42cc50eaaf96e29710
36d359de0808170809afdb8fa45e4403644de6eb4921eab83917d2952f3b6e2e
4abd169c2e8280b1e13b34af291b91138473bafd4b996ce020363f52371d77b6
43885d920258d6685b0896c6214b22b5c9f242b1ab76e75797abd91b09c52810
c3c30fc030de442cede5c078e0ba3ff227c4c57c10c23c4d7dba78e1147f3428
b5c87ae305492fcb39c332e34bb86cf96e0906d89eb7bedf552b740a877ca97d
cff9fc02dfb06bb740609505345e93c40b2b240734913b1122f2ca68a436bc2c
0cbb7f1b15b8cd50b8269b954738cbad9099994d60df5309ac5326c3886c3d10
8109a0528091c8be7fc71e941604672f1cfba50a020c9b4fce74be6e092764f4
65ca5368c87b5c53a24995aa3bb88240abf1766e2fd013ad10756e5006be286c
e53905be786890e707d3afe844cbb853b3b5db4f52768df923ac867a2659c3b1
897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
8e428ed7bec47c35783cca6568a6a8f8d5229669d1cce764d30ecac9ff9c28d4
SH256 hash:
36aeaa9421322a433e362b755b3d3de2a7450399c2327718b991736458236677
MD5 hash:
241fce05fa2429fb88e613f72542481f
SHA1 hash:
652090f411be91cc5e1a13108ee2674826050487
Detections:
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
win_mal_XWorm
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_AsyncRAT
Create hunting rule
MALWARE_Win_XWorm
Create hunting rule
Link:
https://www.unpac.me/results/121a0275-6c4b-4afd-854a-6a1b9de46f7c/
SH256 hash:
da59224e4a48584a44f7a7fb5a1eef8279ffcded8e9555ec65542b576f0029bc
MD5 hash:
b33d22178e1d02b4e362cc13f53f9ca7
SHA1 hash:
6b70062537fc956af90a359f4a289032e71a6db2
Link:
https://www.unpac.me/results/121a0275-6c4b-4afd-854a-6a1b9de46f7c/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RSharedStrings
Create hunting rule
Author:Katie Kleemola
Description:identifiers for remote and gmremote
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe 897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/51302/
  
URLhaus
https://urlhaus.abuse.ch/url/3679158/
  
Delivery method
Distributed via web download

Comments