MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 18

Intelligence 18 IOCs YARA 5 File information Comments

SHA256 hash:	b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5
SHA3-384 hash:	f6d07087a36936d98860adbb247872f35961aa62cee578071bbe66728f55e5a67744a94a151fe55fc33ba5b380eea704
SHA1 hash:	38c9f89926de9fb35eb6c70991ef9f98e7bd9a05
MD5 hash:	3bb5d03fa5aa7873529b7343206e2002
humanhash:	jig-social-echo-november
File name:	EVERGREEN Reschedule Notice= (HTW) MODE 1473-010E to (HTW) MOST 1474-011E.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	631'808 bytes
First seen:	2026-09-29 02:03:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'287 x AgentTesla, 20'689 x Formbook, 12'401 x SnakeKeylogger)
ssdeep	12288:7GE4FoxoBQhBGrvtzXhMoqYYwFhwJLM7awmzASWA0TBqmmoDFpNBHG:g/BQVoqrwFh+w7awmzASWAwz5pNB
TLSH	T1B9D4F0246618DA17C5B617B95270E23117BB8E5EB931D34A8EEDBCDB3B27B441E00393
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	fcb7e8ccccccf3de (1 x AsyncRAT, 1 x RemcosRAT)
Reporter	threatcat_ch
Tags:	AsyncRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

276

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b09c1019-dc06-4a73-b0ae-f3012e9e97b5/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-29 02:08:34 UTC

Tags:

xworm

Link:

https://app.any.run/tasks/1c500a34-7a33-4784-8fe7-72e91d96875d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XWorm

Link:

https://www.capesandbox.com/analysis/89560/

Detection(s):

SecuriteInfo.com.Win32.MalwareX-gen.94557397.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac0ba9559bf6e2f9e92d8f1

Tags:

virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Connection attempt to an infection source

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/6abb1c9f78cca2bb003996df/reports/2193902d-51ca-4e16-b255-a12c64cd7819/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-28T22:48:00Z UTC

Last seen:

2026-10-01T00:25:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5/results?tab=lookup

Malware family:

XWorm

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6587e4f4-92f4-4150-a42c-33bffc22f37b

Result

Threat name:

XWorm

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1979213

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found malware configuration

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.28 Win 32 Exe x86

Link:

https://app.malva.re/file/3bb5d03fa5aa7873529b7343206e2002

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5/

Threat name:

Win32.Backdoor.Xworm

Status:

Suspicious

First seen:

2026-09-29 01:50:49 UTC

AV detection:

12 of 23 (52.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wwbskixjj5p2fj27hax2vo6e6yizbrd4gxtzeqaox6fw2mwhtcsq._file

Result

Malware family:

xworm

Score:

10/10

Tags:

family:xworm discovery rat trojan

Link:

https://tria.ge/reports/260929-chdc1szw5m/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

SmartAssembly .NET packer

Suspicious use of SetThreadContext

Detect Xworm Payload

Family: Xworm

Malware Config

C2 Extraction:

172.94.15.100:6070

Unpacked files

SH256 hash:

b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5

MD5 hash:

3bb5d03fa5aa7873529b7343206e2002

SHA1 hash:

38c9f89926de9fb35eb6c70991ef9f98e7bd9a05

Link:

https://www.unpac.me/results/23c75b67-52f3-4be5-808d-14de64b52c1c/

SH256 hash:

cb32dba898acc1b7559d4518a688d37369292b5e816f9f83a5ac00bedc682cb2

MD5 hash:

3c71a1817a09645858f06bda686f13d2

SHA1 hash:

47cbac86cd1d0c59898ce18da5706e1aa4409ea5

Detections:

INDICATOR_EXE_Packed_SmartAssembly

Link:

https://www.unpac.me/results/23c75b67-52f3-4be5-808d-14de64b52c1c/

Parent samples :

ec4e5a7900d98e13f95ddcc520878c0776da2015238686e37758d0c9b23f9d11
b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5
8a28b491205f27b111b5c851dab1a2fbbbc50f02985a25437362157c8c2f7286
66d3101e3b2207acdbdd9d0c14a1c3ea064e14a771705d8a4583faecaba98544
3e3f0f03a52304570aaf18d4536e8be8a3577e68a198edc53e5877283c18ea5d
905875f98083af8c8f692cded87b1f36e87f68b0c09072aa171a84fb9f957e11
516d6b7a4f5eab1161236eb86edc66b9c676cbf4294fca47545c8480477a8b38
b3217ca3543005ea9d318cda4abdc79af8079d9e1cd60c38e9c042bd8c0b6469
9121ef0f2d7b2cc3c887420ecb1eae214db9cb780433d11565ab8c98a6ad99ec

SH256 hash:

cbd4b136585bb98d8cbb06d3746724f0e6f4cb2068304ca4ae42a51f9f6759bd

MD5 hash:

7367ebb51f4a409742a6a4b377823aa0

SHA1 hash:

9c74c1aae1513c685e2127cb806bc9f99d354244

Link:

https://www.unpac.me/results/23c75b67-52f3-4be5-808d-14de64b52c1c/

SH256 hash:

b83ec3f8d27de262c14b66bf3ef0d5906f1a166546130d3d6cafcc2dc266ce85

MD5 hash:

14f0893774e63dc96ac0f56be446bfc5

SHA1 hash:

df9ec0b17a46cd41f4f1c0167cdca02ed73946d3

Detections:

win_xworm_w0

XWorm

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

MALWARE_Win_AsyncRAT

MALWARE_Win_XWorm

win_mal_XWorm

Link:

https://www.unpac.me/results/23c75b67-52f3-4be5-808d-14de64b52c1c/

Parent samples :

b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5
f7914bc01cc7681047160cdb1c34d6cb548c16045cb4ef4a868de43f9b8f6844
fe0bc62c1859de201d59817578cc79ce2bcb5afdcc25682230e9e5e61c65a5ae
4bfe304587633df9d042ede596f957bace69740c37bc40a6635cabe101802c65
17161ca9b95f7b2550a69cc0f2fce78ae93ae27869f6652fd54cbc2bbec68b38
9262713395e980851638ce2f5bac67be989449f82d76e25d0ef42fa8e59c0863
354ed74cf297bdc4d920e3bb357fea7202856277501cbe914b1dfbe8813e841c
6be0d87cb44236b11c566bb7914d27c0ef550487d8e42926a8f7331eb76f5f5a
4fa2289b4213bf093d4e100476ae25f553d3346d3729ad83f8e469f2cee49064
74eed7f4eb2c03328276103558991ba872db23c73b1dd66a97446c80c9e147d5

Malware family:

XWorm

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b5832522e94f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	HUNT_NET_Loader_ImagePixel_To_AssemblyLoad Create hunting rule
Author:	Anish Bogati
Description:	Hunting: .NET loader that reads pixel data from an embedded image, loads it as a .NET assembly, and runs it via reflection or late binding. Catches bitmap-steganography loaders.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

exe b5832522e94f5fa2a75f382faabbc4f61190c47c35e792400ebf8b6d32c798a5

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/89560/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample