MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b
SHA3-384 hash:	2ac8120e7d464bc0bd1c15a0d81707dd3b7052ae318aeff01ec41b3286f948f30b3df3957493b781c6357b4d1e067ff0
SHA1 hash:	f1d1d5db01de3d7d8f33a5bd41bcddbc89bd4165
MD5 hash:	ba631006bb2036e322b8c7b9c7d3d478
humanhash:	hydrogen-saturn-king-item
File name:	PS.PS1
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	149 bytes
First seen:	2025-12-28 07:40:03 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:VSJJFIGFGMF17Nf/sWvER6fWZ4IqQRwJAFBALTZHpAUFIjyOGGiTZHpAUYE:s8GFGMFn3sl6fSRwrLTFpAcKzqpA+
Threatray	2 similar samples on MalwareBazaar
TLSH	T160C08C318024013CDD2CDA4AE2A4F99EC0AA6058E2B725A0A8208A4C07203228346030
Magika	powershell
Reporter	JAMESWT_WT
Tags:	2bknb-com 2vbkb-com AsyncRAT booking ps1

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

51

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6950dee96de7591fd8fbf1d1

Tags:

autorun shell overt sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-12-28T05:04:00Z UTC

Last seen:

2025-12-28T12:49:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.PowerShell.c PDM:Trojan.Win32.Generic Trojan-Dropper.Win32.Agent.tkdgcn HEUR:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b/results?tab=lookup

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b/

Neiki Trojan-Dropper.Win32.Agent

Verdict:

Malicious

Threat:

Trojan-Dropper.Win32.Agent

Link:

https://tip.neiki.dev/file/b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wz3svw223ab5dkdpuvjbzd6huqaak35nikgy75md3uepca7vkjvq._file

Threatray anarchypanelrat

Verdict:

malicious

Label(s):

anarchypanelrat

Alert

Create hunting rule

Similar samples:

2e681ab8f0907453efff16c6ba2d06cfe5efde800ea6268bd5b574806a3c4ff0

AsyncRAT

error

AsyncRAT

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default defense_evasion discovery execution persistence rat

Link:

https://tria.ge/reports/251228-jhqrnsgt8h/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Browser Information Discovery

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Creates new service(s)

Drops startup file

Executes dropped EXE

Loads dropped DLL

Stops running service(s)

Badlisted process makes network request

AsyncRat

Asyncrat family

Malware Config

C2 Extraction:

setkapls77.com:4455
setkapls88.com:4455
setkapls99.com:4455

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b6772adb5ad803d1a86fa5521c8fc7a400056fad428d8ff583dd08f103f5526b