MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d
SHA3-384 hash: 9e5715af37ed53ebb9d1aef5d7f2c4bae7b51099ef087698c33f5907570d5f541c41a41330ed9e34fdc159df7b683ce3
SHA1 hash: eb4b03f15d948e410e421d29f2d37238c8e557c8
MD5 hash: e2c8813a45be0ad0665599f8749b8432
humanhash: ten-twelve-thirteen-zebra
File name:Winlogon.js
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:6'290'792 bytes
First seen:2025-11-29 18:22:47 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 192:41n/B8FczE9O9qOJCO1zE9OS7xZRsJE3Hc2JETRbJ9WqSM+a:jMh
Threatray 1'451 similar samples on MalwareBazaar
TLSH T1FC560328F5859416AC77A77F5EB52818F10C3B2F982249F934068BDB87740FD4A28E7D
Magika javascript
Reporter skocherhan
Tags:AsyncRAT hostphpwindowsapps-ydns-eu js


Avatar
skocherhan
http://hostphpwindowsapps.ydns.eu:8011/data/Restore/Winlogon.js

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
GB GB
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692b3a126657e34332824b21
Tags:
obfuscate asyncrat xtreme virus
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 base64 fingerprint obfuscated obfuscated overlay powershell repaired
Link:
https://www.filescan.io/uploads/692b3a101b65ca0bb9278297/reports/8977388a-b954-4047-9527-776503f00cd0/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d
Verdict:
Malicious
File Type:
js
First seen:
2025-11-26T07:43:00Z UTC
Last seen:
2025-11-30T01:37:00Z UTC
Hits:
~10
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.SAgent.gen HEUR:Trojan.Script.Generic
Link:
https://opentip.kaspersky.com/a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d/results?tab=lookup
Score:
8%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d
Verdict:
inconclusive
YARA:
1 match(es)
Link:
https://app.malva.re/file/e2c8813a45be0ad0665599f8749b8432
Detection:
dcrat
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d/
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d
Threat name:
Script-JS.Trojan.ObfPadding
Create hunting rule
Status:
Malicious
First seen:
2025-11-25 14:37:49 UTC
File Type:
Binary
AV detection:
14 of 37 (37.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uoqw25p2klgkj3byg3elpx2o5ztlseya6r6f5rbs7xgtqgnzffgq._file
Verdict:
malicious
Label(s):
dcrat
Create hunting rule
Similar samples:
01ee90a2b1295348dc4495943a09cdaa2941a30476c5f7a3054f905f106068a0
AsyncRAT
270f45d4dadced58852636cd091aa5ba0ca1e54f412ac17d8e807b2e1db1de5c
AsyncRAT
a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d
AsyncRAT
c1129d126820d0b83ec14389944fd8a7ade95e6a980245d37b904623183ddbf1
AsyncRAT
cf668403c5a5d408a2c655ea78f0cd85a9fdd02874fbe62ded2c63c60b9352d8
AsyncRAT
d7c2934b23d03ce5bd00a576024299eb70e3f60f5dab8bf65c1f7aacf419df9f
AsyncRAT
dd351746a9cb17a99e8bd6724cc75a1727dfad4070fcd21ebf2da478e282fd89
AsyncRAT
eaf0cc301ae124b8a2b966a9496e02466390f1557c1dfbfe26da8ffcb3df996c
AsyncRAT
error
AsyncRAT
+ 1'441 additional samples on MalwareBazaar
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:nov 27 discovery execution rat
Link:
https://tria.ge/reports/251129-w1jgjaxjhw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
AsyncRat
Asyncrat family
Process spawned unexpected child process
Malware Config
C2 Extraction:
startmenuexperiencehost.ydns.eu:8849
startmenuexperiencehost.ydns.eu:8848
Dropper Extraction:
http://archive.org/download/optimized_msi_20251125_1103/optimized_MSI.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AcRat
Create hunting rule
Author:Nikos 'n0t' Totosis
Description:AcRat Payload (based on AsyncRat)
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:dcrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:dcrat_kingrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:dcrat_rkp
Create hunting rule
Author:jeFF0Falltrades
Description:Detects DCRat payloads
Rule name:INDICATOR_SUSPICIOUS_EXE_B64_Artifacts
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Rule name:INDICATOR_SUSPICIOUS_EXE_DcRatBy
Create hunting rule
Author:ditekSHen
Description:Detects executables containing the string DcRatBy
Rule name:INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
Create hunting rule
Author:ditekSHen
Description:Detects executables attemping to enumerate video devices using WMI
Rule name:MAL_AsnycRAT
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:MAL_AsyncRAT_Config_Decryption
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:Mal_WIN_AsyncRat_RAT_PE
Create hunting rule
Author:Phatcharadol Thangplub
Description:Use to detect AsyncRAT implant.
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Generic_Threat_ce98c4bc
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_DCRat_1aeea1ac
Create hunting rule
Author:Elastic Security
Rule name:win_asyncrat_unobfuscated
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

c4227451de9021fbef8e86837b3d384ca91cb875c60a17ef9ff761fe5afb7768

AsyncRAT

Java Script (JS) js a3a16d75fa52cca4ec3836c8b7df4eee66b91300f47c5ec432fdcd3819b9294d

(this sample)

  
Dropped by
SHA256 c4227451de9021fbef8e86837b3d384ca91cb875c60a17ef9ff761fe5afb7768
  
Dropped by
SHA256 2b2ec1389c6ba8cf776b93c0322892632f16f978d915dadb3c775f8d2abf464f

Comments