MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 17

Intelligence 17 IOCs YARA 3 File information Comments

SHA256 hash:	91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561
SHA3-384 hash:	df9ac236f38ae70b9a822d13bc8531cffdba5f68ee55c59b60510b5400793056b46262fdaad64eee973f3dc1c39b2bc1
SHA1 hash:	32eb1eb04ffdce6012e24467778552999cf7f011
MD5 hash:	0d60097c07241a4a98fb18196d21d75f
humanhash:	colorado-papa-harry-july
File name:	118.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	433'657 bytes
First seen:	2026-09-04 11:39:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	573bb7b41bc641bd95c0f5eec13c233b (65 x GuLoader, 31 x RemcosRAT, 30 x AgentTesla)
ssdeep	12288:DyWZpwVcYJYkYJ+UmoaQi2oAkpDZAUqYk9nhDXvU:DyWZpDiAxad2oAk36nBhDXvU
TLSH	T146942306FA31C57AE2B20174DDB56D3B4EBE8533866A3D43479074997E614C2D71F382
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter	abuse_ch
Tags:	AsyncRAT exe RAT

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

NSIS

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b90184b6-af52-466d-9e29-b816b423a7b3/

Malware family:

asyncrat

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-04 11:49:10 UTC

Tags:

auto-reg auto-sch auto-startup rat donutloader loader amsi-bypass asyncrat

Link:

https://app.any.run/tasks/85948386-b3e0-4a9c-91e9-4d1e4939eb06

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

VenomRAT

Link:

https://www.capesandbox.com/analysis/83897/

Detection(s):

SecuriteInfo.com.FileRepMalware.72638799.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Creating a process from a recently created file

Creating a file in the %temp% directory

Enabling the 'hidden' option for recently created files

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a file in the %AppData% subdirectories

Сreating synchronization primitives

Connection attempt

Creating a window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Setting a global event handler for the keyboard

Enabling autorun by creating a file

Enabling autorun

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug cdb cmd crypto expired-cert fingerprint installer installer lolbin microsoft_visual_cc nsis reconnaissance remote

Link:

https://www.filescan.io/uploads/6a9aade81ace536fb06621bb/reports/6d1c4aeb-670e-4eed-aeb2-3fe8ab859cec/overview

Verdict:

Malicious

Labled as:

High_entropy

Link:

https://www.hybrid-analysis.com/sample/91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-04T08:27:00Z UTC

Last seen:

2026-09-05T21:23:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a0a34ab7-cd68-4c2e-8765-a917f79e469e

Result

Threat name:

DonutLoader, VenomRAT

Detection:

malicious

Classification:

troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1968544

Signature

Checks for kernel debuggers (COM1)

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Creates an undocumented autostart registry key

Drops PE files to the startup folder

Found API chain indicative of debugger detection

Installs a global keyboard hook

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Suspicious Program Location with Network Connections

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Unusual module load detection (module proxying)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected DonutLoader

Yara detected VenomRAT

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable NSIS Installer PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/0d60097c07241a4a98fb18196d21d75f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-09-04 11:40:31 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=sgchuudv7uhjhd2k5q5chjcdprsel5ho7qqb7iui4divcpw7avqq._file

Verdict:

malicious

Label(s):

AsyncRAT

DonutLoader

Link:

https://reports.threatray.com/37413e34-0959-4589-8d06-59d5c9ad4772

Result

Malware family:

donutloader

Score:

10/10

Tags:

family:asyncrat family:donutloader discovery execution loader persistence privilege_escalation rat

Link:

https://tria.ge/reports/260904-nsffxawvbw/

Behaviour

Checks SCSI registry key(s)

Modifies registry class

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks installed software on the system

Enumerates connected drives

Creates a file in the Startup directory

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Async RAT payload

Detects DonutLoader

Family: AsyncRat

Family: DonutLoader

Unpacked files

SH256 hash:

91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561

MD5 hash:

0d60097c07241a4a98fb18196d21d75f

SHA1 hash:

32eb1eb04ffdce6012e24467778552999cf7f011

Link:

https://www.unpac.me/results/fe9ec812-0079-462b-a2bd-7eb426470afc/

SH256 hash:

753ae21c59c5fca92ea476e64383371dc0f146d574be013fce3563cb39265ae5

MD5 hash:

dadf5983741e55982ddc8d59e49f011a

SHA1 hash:

eafa417935e0b4a6b8835fb207afbb39a567ef98

Link:

https://www.unpac.me/results/fe9ec812-0079-462b-a2bd-7eb426470afc/

SH256 hash:

53abcbd55948172502618a66218a7d68ea986106e084cd07bd4c9321d58689f7

MD5 hash:

61b25e84079ba06aa146415cbbb49203

SHA1 hash:

8064c75f805fb79789518be8202e1ec96d042617

Link:

https://www.unpac.me/results/fe9ec812-0079-462b-a2bd-7eb426470afc/

SH256 hash:

db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3

MD5 hash:

075d1d7228143a189f71ef74f4bcb6a5

SHA1 hash:

44ae02db647ee02c3242467e87dd0cf8fe1de03d

Link:

https://www.unpac.me/results/fe9ec812-0079-462b-a2bd-7eb426470afc/

Malware family:

DCRat

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/91847a5075fd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/91847a5075fd0e938f4aec3a23a4437c6445f4eefc201fa288e0d1513edf0561

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_NSIS_Nullsoft_Installer Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects NSIS installers by .ndata section + NSIS header string

Rule name:	NSIS Create hunting rule
Author:	kevoreilly
Description:	NSIS Integrity Check function

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.