MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f
SHA3-384 hash:	93dbbe2dee2bd9bb7a371bf2ac37909f9a486d70c89b2af67be8948d71f5f40b6c868f301273f162f0459466fea87d2e
SHA1 hash:	21bc86cafe589e6423b9b9ba92ac4ce51e43e705
MD5 hash:	151aed30e8c7e93ec86cc7c2a934cdb0
humanhash:	nevada-sodium-minnesota-lithium
File name:	cmd.bat
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	718 bytes
First seen:	2025-04-06 05:44:15 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	12:wb4u4XYRdgod1FIfYofh/ibfWfmWfEzflbfdfL8fOzffofoZjbfebffzf3f0Cf5p:wKXYaobFIgoob+OWM9bFz8GzXoQZfGbN
TLSH	T14801D152414EA55046F7AD820CE41872276DC3D20B34E4FD2CC79C48D0BD4EBCF1A418
Magika	batch
Reporter	abuse_ch
Tags:	AsyncRAT bat RAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN asyncrat

Malware family:

asyncrat

Alert

Create hunting rule

ID:

1

File name:

b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f.zip

Verdict:

Malicious activity

Analysis date:

2025-04-06 06:09:27 UTC

Tags:

arch-exec loader rat asyncrat remote

Link:

https://app.any.run/tasks/ddbdd893-5eb1-4ad1-b692-b8108c610742

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/870/

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f2169fe011fe619fab78f5

Tags:

trojan shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

Creating a file in the %temp% subdirectories

Creating a process with a hidden window

Creating a file

Searching for the window

Using the Windows Management Instrumentation requests

Connection attempt to an infection source

Sending a TCP request to an infection source

Sending an HTTP GET request to an infection source

Unauthorized injection to a system process

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/67f2184f2d430c849e089b42/reports/5a3081a0-417a-405c-a5fc-13437dc653bc/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f

Joe Sandbox AsyncRAT, DcRat

Result

Threat name:

AsyncRAT, DcRat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1657591

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

Compiles code for process injection (via .Net compiler)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: PowerShell Download and Execution Cradles

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected AsyncRAT

Yara detected Costura Assembly Loader

Yara detected DcRat

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

32%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f/

ReversingLabs TitaniumCloud Script-BAT.Downloader.FakeCaptcha

Threat name:

Script-BAT.Downloader.FakeCaptcha

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-05 22:54:54 UTC

File Type:

Text (Batch)

AV detection:

11 of 24 (45.83%)

Threat level:

  3/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xdp6kv2gppa3h33zazmir777rvqardskjzsi3afst76ayebwv4xq._file

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default discovery execution rat

Link:

https://tria.ge/reports/250406-gp2fmssxht/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Downloads MZ/PE file

AsyncRat

Asyncrat family

Malware Config

C2 Extraction:

92.255.85.2:1414

Dropper Extraction:

http://92.255.85.2/a.mp4

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

bat b8dfe557467bc1b3ef79065888ffff8d60088e4a4e648d80b29ffc0c1036af2f

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3490718/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/870/