MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8cab36ad895820e9a9e36ac49bf91a16e6645a202906332ca7b0f3a5c49e6b64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AsyncRAT
Vendor detections: 7
| SHA256 hash: | 8cab36ad895820e9a9e36ac49bf91a16e6645a202906332ca7b0f3a5c49e6b64 |
|---|---|
| SHA3-384 hash: | c105d102d85dd47a0e8d81a4ca1d930f4593ef67d92aa48fa6b5c1c64d8b8c82060ffbb86c22bbdb45f8f100c95581b7 |
| SHA1 hash: | 2a9bea3055ae709200fab42b7d00b9d849fee4b4 |
| MD5 hash: | 50f72ee8636187649114b388ef5f09c5 |
| humanhash: | one-mike-six-berlin |
| File name: | Acusacion de Acciones Delictivas Juzgado 10 Penal Circuito Conocimiento_.zip |
| Download: | download sample |
| Signature | AsyncRAT |
| File size: | 695'110 bytes |
| First seen: | 2026-03-16 13:29:17 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| Note: | This file is a password protected archive. The password is: infected |
| ssdeep | 12288:N1nlfnJC6L8x/la+f7H7iJgNSe3+SQPY+GhWGNUy0gZ3qPXcNwXvrmJD:N1nl8/wo7H7aiS1SQPY+GhWGtaUYvyJD |
| TLSH | T133E4333315C6E3CFF9A21A24C745E0C30E3B17E42AF82317B9419E0D87662B676999B5 |
| Magika | zip |
| Reporter |  cypherpunk472 |
| Tags: | AsyncRAT infected javascript svg zip |
cypherpunk472
Malicious SVG attachment with obfuscated javascript code for dowloading zip aes protected file containing the payloadIntelligence
File Origin
# of uploads :
1
# of downloads :
127
Origin country :
COFile Archive Information
This file is a password protected archive. The password is: infected
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Acusacion de Acciones Delictivas Juzgado 10 Penal Circuito Conocimiento_.svg |
|---|---|
| File size: | 958'715 bytes |
| SHA256 hash: | 30b229106bad5c96e13c61ba8437c8ce5778d5835647bfc5689c7272d725e935 |
| MD5 hash: | 6b4e2f9d9619fd208f7b471aff186f1e |
| MIME type: | image/svg+xml |
| Signature | AsyncRAT |
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Tags:
n/a
Result
Verdict:
Clean
File Type:
JS File
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 obfuscated
Result
Verdict:
MALICIOUS
Link:
Verdict:
Unknown
File Type:
zip
Score:
38%
Verdict:
Susipicious
File Type:
ARCHIVE
Gathering data
Threat name:
Binary.Trojan.Generic
Status:
Suspicious
First seen:
2026-03-16 13:21:53 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
3 of 24 (12.50%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
5/10
Tags:
adware discovery javascript spyware svg
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
AsyncRAT
zip 8cab36ad895820e9a9e36ac49bf91a16e6645a202906332ca7b0f3a5c49e6b64
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.