MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95d08288a2c448d82aa1217320bfe79c69a6dfb0e6aed9f64a855c81d85fe139. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	95d08288a2c448d82aa1217320bfe79c69a6dfb0e6aed9f64a855c81d85fe139
SHA3-384 hash:	815a6fb1306d7acb38bb0975ba47228fee9eb943c3fe285f2b36815e06ae6448cac6e418ff451c543399636bcc638456
SHA1 hash:	4bc1593cc6d000d50601f603fa6c9de0ab34b38d
MD5 hash:	1505f189e91389b8a7fd6670714182ed
humanhash:	river-eleven-sink-fourteen
File name:	PO-JCAPS-2609-001.vbs
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	5'167'528 bytes
First seen:	2026-09-30 08:30:15 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	1536:+xjQN+XI5S1yrUMSJszsrzx6v9c18Gsd4UZlC2DMPcL/MW5pMY0KZzlNnU/2orL3:W
TLSH	T157364CC37B38C7B5E3912B6F4B2682E922CEB5E4055B9C7B4D46A80E8534B312CF7558
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	abuse_ch
Tags:	AsyncRAT vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

167

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/89841/

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6abcc8bcff8b03318b38c4d3/reports/68e94572-bef7-46e8-9c13-97aaecfcb813/overview

Hybrid Analysis VBS/TrojanDownloader.Agent

Verdict:

Suspicious

Labled as:

VBS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/95d08288a2c448d82aa1217320bfe79c69a6dfb0e6aed9f64a855c81d85fe139

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-09-30T02:24:00Z UTC

Last seen:

2026-10-01T06:50:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/95d08288a2c448d82aa1217320bfe79c69a6dfb0e6aed9f64a855c81d85fe139/results?tab=lookup

Joe Sandbox AsyncRAT

Result

Threat name:

AsyncRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1979846

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Bypasses PowerShell execution policy

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Powershell connects to network

Sample uses string decryption to hide its real strings

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell DownloadFile

Sigma detected: Suspicious Environment Variable Has Been Registered

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to download and execute files (via powershell)

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected AsyncRAT

Yara detected Generic Downloader

Behaviour

Behavior Graph:

Download SVG

Malva.RE

Gathering data

CERT.PL MWDB asyncrat

Detection:

asyncrat

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/95d08288a2c448d82aa1217320bfe79c69a6dfb0e6aed9f64a855c81d85fe139/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sxiifcfcyrenqkvbefzsbp7htru2nx5q42xnt5skqvoidwc74e4q._file

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default discovery execution persistence rat suricata

Link:

https://tria.ge/reports/260930-keltzsyw6r/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Enumerates connected drives

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: AsyncRat

Process spawned unexpected child process

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound

Malware Config

C2 Extraction:

lg.sonqhong.com:80
lg.sonqhong.com:443
lg.sonqhong.com:8080

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.21

Link:

https://yomi.yoroi.company/submissions/95d08288a2c448d82aa1217320bfe79c69a6dfb0e6aed9f64a855c81d85fe139

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/89841/