MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
SHA3-384 hash: ffe9bcfcefbd07705af2159ff15bc9a21f288c7e87f0e40087fc41426a43844a442c6fec2baeed3c4f161ee2686c98f2
SHA1 hash: 71c9ed9bceb24c2fcac4ffc96a775434eba02eb5
MD5 hash: 002b1550152a4ca76ff1b2497a6c016e
humanhash: crazy-equal-network-tango
File name:SecuriteInfo.com.Win32.MalwareX-gen.34194236
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:832'000 bytes
First seen:2025-12-28 06:19:37 UTC
Last seen:2025-12-28 07:17:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'610 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:TkL9DQFWsR/jOHaT2JleKYLsLsy0oxNQhhD2EXrc0F8zNhqUoPUx2ZuD1e0Bun+7:u/W+m8n14qO94Jy/dVc82U0oPEq1S
Threatray 4 similar samples on MalwareBazaar
TLSH T11D05BE6523F85A58F5BFAF79547159140BF2F84AEE32E30D6A4950ED0C72B80CA62733
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Malware family:
dcrat
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.MalwareX-gen.34194236
Verdict:
Malicious activity
Analysis date:
2025-12-28 06:28:59 UTC
Tags:
auto-reg auto-startup rat dcrat remote darkcrystal netreactor asyncrat
Link:
https://app.any.run/tasks/7f8439e2-352e-4390-b01b-ad548c7135c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DCRat
Create hunting rule
Link:
https://www.capesandbox.com/analysis/46260/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.34194236.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6950cc254503237b77fbe7aa
Tags:
autorun micro shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin obfuscated obfuscated packed tracker vbnet
Link:
https://www.filescan.io/uploads/6950cc2aeb6298f4c857501b/reports/f8208e77-5bfa-4856-a7d7-76e111399517/overview
Verdict:
Malicious
Labled as:
Trojan.MSIL.Basic.8
Link:
https://www.hybrid-analysis.com/sample/aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-28T03:51:00Z UTC
Last seen:
2025-12-28T04:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/01b7eece-ee2d-4d4a-9606-71342063fc6a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86
Link:
https://app.malva.re/file/002b1550152a4ca76ff1b2497a6c016e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-28 06:20:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ving2lrw4wpzeyc6bzns3yy77j5qfl4a77avzll4t5aj3ppqrutq._file
Verdict:
malicious
Label(s):
unc_loader_078
Create hunting rule
asyncrat
Create hunting rule
Similar samples:
5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
AsyncRAT
aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
AsyncRAT
error
AsyncRAT
Result
Malware family:
asyncrat
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat botnet:default discovery persistence rat
Link:
https://tria.ge/reports/251228-g3w33sfv9b/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Adds Run key to start application
.NET Reactor proctector
Drops startup file
Executes dropped EXE
AsyncRat
Asyncrat family
Malware Config
C2 Extraction:
sssdow.redirectme.net:3232
91.92.242.87:3232
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/69b1e9ea-604c-4f9c-b884-bb25aa053b5f
Unpacked files
SH256 hash:
aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
MD5 hash:
002b1550152a4ca76ff1b2497a6c016e
SHA1 hash:
71c9ed9bceb24c2fcac4ffc96a775434eba02eb5
Link:
https://www.unpac.me/results/f12399a9-82ef-41a2-b7cb-789d960645b6/
SH256 hash:
2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 hash:
0e362e7005823d0bec3719b902ed6d62
SHA1 hash:
590d860b909804349e0cdc2f1662b37bd62f7463
Link:
https://www.unpac.me/results/f12399a9-82ef-41a2-b7cb-789d960645b6/
SH256 hash:
d1cf46d72ba82426cc92bc0be80220d462286fb5e1791fb04adaa8950c0bd238
MD5 hash:
a2b3f41d3eb6e5107015e1a7a36335ba
SHA1 hash:
6cd09f228e9c9ed161d89e0994e6ec6133cf6c0b
Link:
https://www.unpac.me/results/f12399a9-82ef-41a2-b7cb-789d960645b6/
SH256 hash:
3d2f6b6847ba4075b18b095db2e0167e38313621f41eca9ef234c601a67b47c3
MD5 hash:
80a6f3cbb0165e88d4489bdf25e8f0c7
SHA1 hash:
b6313773af29c5ba531825990ddc0f14c1c3c4bd
Detections:
AsyncRAT
Create hunting rule
DCRat
Create hunting rule
win_asyncrat_unobfuscated
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_DcRatBy
Create hunting rule
Link:
https://www.unpac.me/results/f12399a9-82ef-41a2-b7cb-789d960645b6/
SH256 hash:
07cefe40a185afd840d138acb90a344a477e21bc24dbf50ca1a11478d31a66b5
MD5 hash:
35790dc0f15a083a3e1b0d06e734b80a
SHA1 hash:
d03bfe9ae9f31061f5ade04f2fe15fd583cce655
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
INDICATOR_EXE_Packed_DotNetReactor
Create hunting rule
Link:
https://www.unpac.me/results/f12399a9-82ef-41a2-b7cb-789d960645b6/
Parent samples :
1c0a6d90e8b34ef3b8406be47df82bccc16a1811ea3762cf5951b1a1f3ac02c3
6bf81a58f47093727e85a5175d3b7042384159ce7088fa94b4476bda09ea401e
5f4a7d9028089b7be46f98d664878d01cf67238d25bdfd7daf17c2a4f5d0d726
aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
SH256 hash:
222b04688d1e2030192b188f099ecfd52bd7af6b986ac93e141a80f2766da879
MD5 hash:
c71e17acab65a4dd054c78c0481c7674
SHA1 hash:
63b0d563f15ab5b92c337ef37d741004623d0f62
Link:
https://www.unpac.me/results/f12399a9-82ef-41a2-b7cb-789d960645b6/
SH256 hash:
2673d470353413edfb567ff7479395dc52824db6469520ebe8d91dbca2bccac2
MD5 hash:
e5be1fdba36d5032726313afe4c7dd63
SHA1 hash:
c65ebe77906cec3bcb5e805a327f1aa823be57ca
Link:
https://www.unpac.me/results/f12399a9-82ef-41a2-b7cb-789d960645b6/
Malware family:
SectopRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aa1a6d2e36e5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46260/

Comments