MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 59 File information Comments

SHA256 hash:	a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f
SHA3-384 hash:	932a255aa6ebd857c1371b0c29da7bf824332e825d544cc18558a3fe6b8bac8d9bf5308e706c1e93bb1dbb54ee6f67e8
SHA1 hash:	44e5206b1b95761ac726a33e5801d7ce58e6fd3d
MD5 hash:	a686b29f491b1779cf0e616dbee999e8
humanhash:	angel-cat-friend-venus
File name:	vbs.vbs
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	6'198'070 bytes
First seen:	2025-10-01 22:33:10 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	49152:SKDiNloyICCodqKCIlJA6hKvFyMY9MPkVA3XkGDszbgH:tCHCh
TLSH	T115561A73E75871720793809748D7A3026336921BF2225578B6CDC2986F4A5B9C3F36FA
Magika	yaml
Reporter	GDHJDSYDH1
Tags:	AsyncRAT backdoor Downloader mimikatz TrickBot vbs

Intelligence

File Origin

# of uploads :

# of downloads :

458

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/29853/

Detection(s):

sigs.InterServer.net.HEX.Topline.eval.post.428.UNOFFICIAL

YARA.eval_post.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ddaa1a40b7da0b4eb966ee

Tags:

trickbot vmdetect mimikatz emotet

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm evasive hacktool javascript macros mimikatz netsh ransomware wmiexec

Link:

https://www.filescan.io/uploads/68ddac43ecfabf8ba43f68c7/reports/e54888f5-73c3-41d0-b977-ab5c3a9677a9/overview

Verdict:

Malicious

Labled as:

Worm/JS.Bondat

Link:

https://www.hybrid-analysis.com/sample/a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f

Verdict:

Malicious

File Type:

hta

First seen:

2025-09-27T10:21:00Z UTC

Last seen:

2025-10-02T05:41:00Z UTC

Hits:

~10000

Detections:

Trojan.Win32.Poweliks.a HEUR:Trojan.Win32.Generic HEUR:Trojan.PowerShell.Generic

Link:

https://opentip.kaspersky.com/a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f/results?tab=lookup

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f/

Verdict:

Malicious

Threat:

Trojan.Win32.Poweliks

Link:

https://tip.neiki.dev/file/a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f

Threat name:

Script-BAT.Trojan.Heuristic

Status:

Malicious

First seen:

2025-09-27 04:16:00 UTC

AV detection:

9 of 38 (23.68%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uyio6drxv5aivje4oklneodznrl2yrnkrmeatttsxrgxlmr735hq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/251001-2graxssye1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a610ef0e37af408aa49c7296d238796c57ac45aa8b0809ce72bc4d75b23fdf4f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BatModifier2 Create hunting rule
Author:	Madhav
Description:	This is a bat file which is setup a game. 49509

Rule name:	Bolonyokte Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	UnknownDotNet RAT - Bolonyokte

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	Check_Qemu_Description Create hunting rule

Rule name:	Check_VBox_Description Create hunting rule

Rule name:	Check_VBox_VideoDrivers Create hunting rule

Rule name:	ciscotools Create hunting rule
Author:	Tim Brown @timb_machine
Description:	Cisco tools

Rule name:	CMD_Shutdown Create hunting rule
Author:	adm1n_usa32

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Detect_Remcos_RAT Create hunting rule
Author:	daniyyell
Description:	Detects Remcos RAT payloads and commands

Rule name:	detect_tiny_vbs Create hunting rule
Author:	daniyyell
Description:	Detects tiny VBS delivery technique

Rule name:	Detect_Zoom_Invite_malware_RAT_C2 Create hunting rule
Author:	daniyyell
Description:	Detects Zoom Invite Call Leading to Malware Hosted in Telegram C2

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	ESXi_Ransomware_Royal_params Create hunting rule
Author:	albertzsigovits
Description:	Detection for Royal ransomware on ESXi

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	HackTool_Producers Create hunting rule
Description:	Hacktool Producers String

Rule name:	Hacktool_Strings_p0wnedShell Create hunting rule
Author:	Florian Roth
Description:	Detects strings found in Runspace Post Exploitation Toolkit
Reference:	https://github.com/Cn33liz/p0wnedShell

Rule name:	Hacktool_Strings_p0wnedShell_RID3234 Create hunting rule
Author:	Florian Roth
Description:	p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShell.cs
Reference:	https://github.com/Cn33liz/p0wnedShell

Rule name:	html_auto_download_b64 Create hunting rule
Author:	Tdawg
Description:	html auto download

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_fodhelper Create hunting rule
Author:	ditekSHen
Description:	detects Windows exceutables potentially bypassing UAC using fodhelper.exe

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	Detects command variations typically used by ransomware

Rule name:	Invoke_WMIExec_Gen_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Invoke-WmiExec or Invoke-SmbExec
Reference:	https://github.com/Kevin-Robertson/Invoke-TheHash

Rule name:	Invoke_WMIExec_Gen_1_RID2E57 Create hunting rule
Author:	Florian Roth
Description:	Detects Invoke-WmiExec or Invoke-SmbExec
Reference:	https://github.com/Kevin-Robertson/Invoke-TheHash

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	MALWARE_Win_AsyncRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AsyncRAT

Rule name:	Mimikatz_Memory_Rule_1 Create hunting rule
Author:	Florian Roth
Description:	Detects password dumper mimikatz in memory

Rule name:	Multi_Ransomware_Akira_21842eb3 Create hunting rule
Author:	Elastic Security

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RDPWrap Create hunting rule
Author:	@bartblaze
Description:	Identifies RDP Wrapper, sometimes used by attackers to maintain persistence.
Reference:	https://github.com/stascorp/rdpwrap

Rule name:	Suspicious_PS_Strings Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	observed set of strings which are likely malicious, observed with Jupyter malware.
Reference:	http://security5magics.blogspot.com/2020/12/tracking-jupyter-malware.html

Rule name:	SUSP_Disable_ETW_Jun20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects method to disable ETW in ENV vars before executing a program
Reference:	https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3

Rule name:	SUSP_Netsh_PortProxy_Command Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspicious command line with netsh and the portproxy command
Reference:	https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy

Rule name:	SUSP_Netsh_PortProxy_Command_RID3201 Create hunting rule
Author:	Florian Roth
Description:	Detects a suspicious command line with netsh and the portproxy command
Reference:	https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy

Rule name:	SUSP_PowerShell_Download_Temp_Rundll Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detect a Download to %temp% and execution with rundll32.exe

Rule name:	SUSP_Scheduled_Tasks_Create_From_Susp_Dir Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	testlumma Create hunting rule

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	virustotal Create hunting rule
Author:	Tracel

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Windows_Trojan_Netwire_1b43df38 Create hunting rule
Author:	Elastic Security
Reference:	https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction

Rule name:	WIN_ClickFix_Detection Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:	ClickFix social engineering and malicious PowerShell commands

Rule name:	WIN_FileFix_Detection Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:	FileFix social engineering with PowerShell and PHP commands