MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f74f26d860462bc36eda7c8216735651599c65832305deb752acdd368a66ba4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	8f74f26d860462bc36eda7c8216735651599c65832305deb752acdd368a66ba4
SHA3-384 hash:	43171594a433a65ffd4cb2ef9e78ad23108d96e08e44555bfbec48c4250c0a778030169bb571ea0e1d1f1938a9fc05b8
SHA1 hash:	40fe91876faaf67884a3efb7b01e015037047126
MD5 hash:	6fc5f52b87d78b577f11b6d2c9a33013
humanhash:	east-ohio-oranges-equal
File name:	run.ps1
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	2'340 bytes
First seen:	2025-07-10 16:15:57 UTC
Last seen:	2025-07-31 12:31:37 UTC
File type:	ps1
MIME type:	text/plain
ssdeep	48:P6qMu1KNW/wziFfQEJF6VZunBmjxjv26r6KJyRHIlzb:P6nQnw966ImhIQn
TLSH	T15441F135710206250BB2873598C65125EEA8413B571E5859FC9C51981FB6356C3FAFEC
Magika	powershell
Reporter	narad11111
Tags:	booking.com bookingm ClickFix ps1

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686fe751900df8e7f869645e

Tags:

shell spawn remo

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 base64 configsecuritypolicy dropper evasive fingerprint hacktool lolbin mpcmdrun msconfig packed powershell reconnaissance regedit schtasks

Link:

https://www.filescan.io/uploads/686fe76630bf733323368ffe/reports/f72a3856-f0f2-4c7a-ac26-e3051369a0c2/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8f74f26d860462bc36eda7c8216735651599c65832305deb752acdd368a66ba4

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8f74f26d860462bc36eda7c8216735651599c65832305deb752acdd368a66ba4

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8f74f26d860462bc36eda7c8216735651599c65832305deb752acdd368a66ba4/

Threat name:

Script-PowerShell.Spyware.AsyncRAT

Status:

Malicious

First seen:

2025-07-10 16:16:18 UTC

File Type:

Text (PowerShell)

AV detection:

7 of 24 (29.17%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r52pe3mgarrlynxnu7ecczzvmukztrsygiyf323vflg5g2fgnosa._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/250710-tqw9jawzfw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8f74f26d860462bc36eda7c8216735651599c65832305deb752acdd368a66ba4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)