MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 15 File information Comments

SHA256 hash:	a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5
SHA3-384 hash:	286ce4ed38c143a57949ba2567b6796a0a9f2291a21550d17f153d6b8308d819850a96191bd3a186ed92df9016d0a935
SHA1 hash:	10870da4f1880f7b48ce2530c929f4d5c8760cc1
MD5 hash:	d3731f0b18e95da5c477cce1c13913ca
humanhash:	delta-nebraska-early-fanta
File name:	a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5.bin
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	8'670'720 bytes
First seen:	2025-08-11 16:40:32 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep	196608:R4HkUqgBKkUYp81IknE2eZnl5PrT3KUwaUmcmSKgge:2MgBKkUYp81Ik1eZl5jTawUmcmOge
TLSH	T100962205A2F2CE06C3C52B7AB11A962C0BB5D0A5B747F38F1F3D94906E9927D4A637C1
TrID	66.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.5% (.EXE) Win64 Executable (generic) (10522/11/4) 5.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	b0236b33961f8ecc (4 x AsyncRAT, 1 x njrat)
Reporter	Neiki
Tags:	AsyncRAT discord RAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Venom RAT + HVNC + Stealer + Grabber.exe

Verdict:

No threats detected

Analysis date:

2024-01-27 04:23:13 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3ad3cc23-8d88-4c81-a723-f78d622af906

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/20182/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689a1558fca70bd90e8e4055

Tags:

virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cryptor_detected net_reactor obfuscated obfuscated packed packed vbnet zusy

Link:

https://www.filescan.io/uploads/689a1d0c2fbe0788fb1da479/reports/035936dc-36bf-4506-8d5a-0df928e759b1/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f18b7341-e136-43c2-889f-0e4a7393e551

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5/

Verdict:

Malicious

Threat:

Family.ASYNCRAT

Link:

https://tip.neiki.dev/file/a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5

Threat name:

ByteCode-MSIL.Trojan.Negasteal

Status:

Malicious

First seen:

2023-11-12 13:35:38 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

22 of 36 (61.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=udpr6rptspc3espxp5l4ezd73adddxq2vj35xqyy3xmfhk5577sq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/250811-t6wmyazwgz/

Behaviour

Suspicious use of AdjustPrivilegeToken

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/76d46e9c-240d-492c-976a-d24c34a9273b

Unpacked files

SH256 hash:

a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5

MD5 hash:

d3731f0b18e95da5c477cce1c13913ca

SHA1 hash:

10870da4f1880f7b48ce2530c929f4d5c8760cc1

Link:

https://www.unpac.me/results/89e8126a-803f-454a-9c38-2ca0a87fe4bb/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	DotNet_Reactor Create hunting rule
Author:	@bartblaze
Description:	Identifies .NET Reactor, which offers .NET code protection such as obfuscation, encryption and so on.

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	INDICATOR_EXE_Packed_DotNetReactor Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with unregistered version of .NET Reactor

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	PureCrypter Create hunting rule
Author:	@bartblaze
Description:	Identifies PureCrypter, .NET loader and obfuscator.
Reference:	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/20182/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (NX_COMPAT)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample