🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988
SHA3-384 hash: 319a097d0d64ddd331efcca70071efbce8d4e6bc4678c947b5e49eb861657bd76777bb90f717e988f60183bd920f2dc9
SHA1 hash: 7bdfd45bea347ec124bceb9c978bed820afff30e
MD5 hash: 897dc38b4e2b47d1458d1b7ad81c9bed
humanhash: robert-missouri-sweet-william
File name:118.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:443'658 bytes
First seen:2026-09-04 11:38:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 573bb7b41bc641bd95c0f5eec13c233b (64 x GuLoader, 31 x RemcosRAT, 30 x AgentTesla)
ssdeep 12288:DyWZp8VcYJi9lM76xowP5pSkzTWV92QgpK0oEO+M+AUqYk9nhDXv+:DyWZpvFUmfDM1AK0oH+/6nBhDXv+
TLSH T10C942362F930CD3FD0531539697FA41E1DE6B57679200B0B6BA02C663877C829B1F7A2
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:AsyncRAT exe RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/71abf1ac-2160-4fc6-9a94-62f98eedd393/
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-04 11:46:45 UTC
Tags:
auto-reg auto-startup donutloader loader asyncrat amsi-bypass rat
Link:
https://app.any.run/tasks/51aa256c-095b-436b-8332-31939c62486b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
VenomRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83895/
Detection(s):
SecuriteInfo.com.Trojan.Siggen33.65098.7685.15385.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a file in the %temp% directory
Enabling the 'hidden' option for recently created files
Running batch commands
Using the Windows Management Instrumentation requests
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Connection attempt
Creating a window
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Setting a global event handler for the keyboard
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug cdb cmd crypto expired-cert fingerprint installer installer installer-heuristic lolbin microsoft_visual_cc nsis reconnaissance remote
Link:
https://www.filescan.io/uploads/6a9aade9c20c32592ab1f34d/reports/81448ed9-5271-427d-80f6-d257680e6c11/overview
Verdict:
Malicious
Labled as:
High_entropy
Link:
https://www.hybrid-analysis.com/sample/aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-04T04:14:00Z UTC
Last seen:
2026-09-04T06:49:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fdf33f6e-bc75-4680-8d28-77ecb0d937c3
Result
Threat name:
DonutLoader, VenomRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1968546
Signature
AI detected malicious Powershell script
Antivirus detection for dropped file
Bypasses PowerShell execution policy
Contains functionality to capture screen (.Net source)
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found API chain indicative of debugger detection
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Program Location with Network Connections
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Unusual module load detection (module proxying)
Yara detected DonutLoader
Yara detected VenomRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1968546 Sample: 118.exe Startdate: 04/09/2026 Architecture: WINDOWS Score: 100 75 Suricata IDS alerts for network traffic 2->75 77 Malicious sample detected (through community Yara rule) 2->77 79 Antivirus detection for dropped file 2->79 81 13 other signatures 2->81 8 118.exe 9 2->8         started        11 msword.exe 6 2->11         started        14 msword.exe 2->14         started        16 2 other processes 2->16 process3 file4 69 C:\Users\Public\Documents\dbgeng.dll, PE32+ 8->69 dropped 71 C:\Users\Public\Documents\11.exe, PE32+ 8->71 dropped 18 11.exe 2 14 8->18         started        103 Contains functionality to detect hardware virtualization (CPUID execution measurement) 11->103 105 Found API chain indicative of debugger detection 11->105 107 Tries to evade debugger and weak emulator (self modifying code) 11->107 109 2 other signatures 11->109 23 cmd.exe 11->23         started        25 conhost.exe 11->25         started        27 cmd.exe 14->27         started        29 conhost.exe 14->29         started        31 cmd.exe 16->31         started        33 cmd.exe 16->33         started        35 conhost.exe 16->35         started        37 conhost.exe 16->37         started        signatures5 process6 dnsIp7 73 118.107.16.32, 49726, 49739, 7878 CTGSERVERLIMITED-AS-APCTGServerLimitedHK Hong Kong SAR China 18->73 63 C:\Users\user\AppData\...\qbf2xwrp.eyb.tmp, PE32 18->63 dropped 65 C:\Users\Public\Documents\res\msword.exe, PE32+ 18->65 dropped 67 C:\Users\Public\Documents\res\dbgeng.dll, PE32+ 18->67 dropped 83 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->83 85 Tries to evade debugger and weak emulator (self modifying code) 18->85 87 Tries to detect virtualization through RDTSC time measurements 18->87 91 2 other signatures 18->91 39 cmd.exe 1 18->39         started        42 conhost.exe 18->42         started        44 conhost.exe 23->44         started        46 powershell.exe 23->46         started        89 Installs a global keyboard hook 25->89 48 conhost.exe 27->48         started        50 powershell.exe 27->50         started        52 conhost.exe 31->52         started        54 powershell.exe 31->54         started        56 2 other processes 33->56 file8 signatures9 process10 signatures11 93 Bypasses PowerShell execution policy 39->93 58 powershell.exe 37 39->58         started        61 conhost.exe 39->61         started        95 Installs a global keyboard hook 42->95 97 Loading BitLocker PowerShell Module 50->97 process12 signatures13 99 Loading BitLocker PowerShell Module 58->99 101 Installs a global keyboard hook 61->101
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/897dc38b4e2b47d1458d1b7ad81c9bed
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vkf7smbj5xywpnxkudh36k3ajeg2r6pfpchioh76tq3d2rlihgea._file
Verdict:
malicious
Label(s):
AsyncRAT
Create hunting rule
DonutLoader
Create hunting rule
GentleKiller
Create hunting rule
Link:
https://reports.threatray.com/5accf66f-2517-4462-a4c5-c9df0ea7b621
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:donutloader discovery execution loader persistence privilege_escalation rat
Link:
https://tria.ge/reports/260904-nse55swvbt/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks installed software on the system
Creates a file in the Startup directory
Executes dropped EXE
Loads dropped DLL
Async RAT payload
Detects DonutLoader
Family: AsyncRat
Family: DonutLoader
Unpacked files
SH256 hash:
aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988
MD5 hash:
897dc38b4e2b47d1458d1b7ad81c9bed
SHA1 hash:
7bdfd45bea347ec124bceb9c978bed820afff30e
Link:
https://www.unpac.me/results/894d6845-0c5e-4240-9ebc-1eaa11e67f4e/
SH256 hash:
753ae21c59c5fca92ea476e64383371dc0f146d574be013fce3563cb39265ae5
MD5 hash:
dadf5983741e55982ddc8d59e49f011a
SHA1 hash:
eafa417935e0b4a6b8835fb207afbb39a567ef98
Link:
https://www.unpac.me/results/894d6845-0c5e-4240-9ebc-1eaa11e67f4e/
SH256 hash:
5118097911c890b794205cb39d156447d30d11a59851ac0340004a7d1fc0e95d
MD5 hash:
afcd7e408673a9e59804225918fc1657
SHA1 hash:
646e1828c37339383d1a58d3286908c1fbd8c145
Link:
https://www.unpac.me/results/894d6845-0c5e-4240-9ebc-1eaa11e67f4e/
SH256 hash:
db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
MD5 hash:
075d1d7228143a189f71ef74f4bcb6a5
SHA1 hash:
44ae02db647ee02c3242467e87dd0cf8fe1de03d
Link:
https://www.unpac.me/results/894d6845-0c5e-4240-9ebc-1eaa11e67f4e/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aa8bf93029ed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:NSIS
Create hunting rule
Author:kevoreilly
Description:NSIS Integrity Check function
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe aa8bf93029edf167b6eaa0cfbf2b60490da8f9e5788e871ffe9c363d45683988

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3910188/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/83895/

Comments