MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 19

Intelligence 19 IOCs YARA 18 File information Comments

SHA256 hash:	c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64
SHA3-384 hash:	14e1531a1e085c64e34a3f80166131c9c5c4fea7d510be3634d30551dd0fbf5f9e7af086051b2aa499e637ec6a401642
SHA1 hash:	5414ec8b6966b24956153cc6baac8dd93c30da92
MD5 hash:	15609d182759b28e6c2970f777731bee
humanhash:	undress-east-alpha-lima
File name:	doc_626656569_C301i26051110150262652652652656525656454267.pdf.scr
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	744'960 bytes
First seen:	2026-05-18 14:21:47 UTC
Last seen:	2026-06-08 09:41:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'075 x AgentTesla, 20'033 x Formbook, 12'353 x SnakeKeylogger)
ssdeep	12288:+EO3nCWRDz1pVPDuvPvahEwE4qjsGB9PJqmWMzmqTDeJ0LPRxjEL149z4:+RCwDJpwXauwpqDqmWIyJcnw
Threatray	115 similar samples on MalwareBazaar
TLSH	T1FCF4126C3B05E10BEA915B385671F379166DADEDB901C2029FD9AEEBFE37E405D00182
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	threatcat_ch
Tags:	AsyncRAT exe

Intelligence

File Origin

# of uploads :

# of downloads :

152

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

RoboSki

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b04a11c1-1d1b-46ad-b964-2379bcc10418/

Malware family:

n/a

ID:

File name:

_c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64.exe

Verdict:

Malicious activity

Analysis date:

2026-05-18 14:23:10 UTC

Tags:

auto-startup xworm

Link:

https://app.any.run/tasks/70d8927e-cb80-4031-a10a-d7ccea27a218

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

XWorm

Link:

https://www.capesandbox.com/analysis/66302/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a0b20aa062bae3f97341eb0

Tags:

underscore autorun

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

Сreating synchronization primitives

Creating a file in the %AppData% directory

Connection attempt to an infection source

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade packed stealer

Link:

https://www.filescan.io/uploads/6a0b20a5efbd399b39b7addc/reports/7fbb9407-0c8b-4f3a-8631-65b4e4550cd4/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-14T03:19:00Z UTC

Last seen:

2026-05-20T08:50:00Z UTC

Hits:

~1000

Detections:

Trojan.MSIL.Crypt.sb Trojan.MSIL.Agent.sb HEUR:Trojan-PSW.MSIL.Agensla.gen Backdoor.MSIL.XWorm.c Backdoor.MSIL.XWorm.b PDM:Trojan.Win32.Badex.c Backdoor.Agent.TCP.C&C Backdoor.MSIL.XWorm.a PDM:Trojan.Win32.Generic Trojan.MSIL.Inject.sb

Link:

https://opentip.kaspersky.com/c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64/results?tab=lookup

Malware family:

XWorm

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/800b10c8-1a06-4b0a-be99-baf86d08fc63

Result

Threat name:

XWorm

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1915087

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Found malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Yara detected XWorm

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.23 Win 32 Exe x86

Link:

https://app.malva.re/file/15609d182759b28e6c2970f777731bee

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64/

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2026-05-14 06:24:10 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=y2zwodg57eqpyahkekkyf3rxh2xrpjno2ga3qx4n6vffoho7xjsa._file

Verdict:

malicious

Label(s):

xworm

wannacryptor

AsyncRAT

6a43cc3ab93e40b4b844ed68fa3ec383683d3835d7c743a38772022951aa6976

AsyncRAT

d556f88c7c96cca6d86986e1fce426fed58bfa5966d59f51854ef6f5c65d1406

AsyncRAT

+ 105 additional samples on MalwareBazaar

Gathering data

Unpacked files

SH256 hash:

c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64

MD5 hash:

15609d182759b28e6c2970f777731bee

SHA1 hash:

5414ec8b6966b24956153cc6baac8dd93c30da92

Link:

https://www.unpac.me/results/d0ef0f55-5e19-468e-995e-235566fceae2/

SH256 hash:

28e998e6cde9ecbf24967433ea1afa2e95f26233f1199460ca0a7f2b34b690b1

MD5 hash:

6815abd4138624b9d6975b742a1e3781

SHA1 hash:

42fdc8ae68242f723ffaa61fb507244b63502c6c

Detections:

win_xworm_a0

win_xworm_w0

XWorm

Link:

https://www.unpac.me/results/d0ef0f55-5e19-468e-995e-235566fceae2/

Parent samples :

cc07b7fc44aba3906470be4b5a285b6e17b4c67f706e4afa6fc694392481c9ae
9b8d72d1a03fbc62aceda0d7e071474fa88f81624ce6aed1fd77f4197cd96305
055e35129e5bc0e4417ee8aeb8a4020825489da13a5e01962f0e69391e51b5f7
b07b9082bfe11919da0905e9b95611817efbc293618ec42cefb82e2ad0d7450d
e82b8b4fda78cdd1b1a4455103362ef508b1d903a3de7bb0ff11c07e8543123f
c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64
8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6

SH256 hash:

2d1016f5d200acf6823a5886d2f3afe70c9b5423800f31d4b8ebfbdac87843af

MD5 hash:

ceec75626e55516dab7c8d666f1af2d7

SHA1 hash:

62475ffca26ecfc8d66dcbab7a1bbf799423e857

Link:

https://www.unpac.me/results/d0ef0f55-5e19-468e-995e-235566fceae2/

SH256 hash:

0a253f3af7fcaad33aa86f8d8ed4216517899bc9d584b8248a49d17fafb9d9df

MD5 hash:

5df98574c4b6883b80d7278249e93963

SHA1 hash:

701e971d378a0ce25d12f1a529ef0716dcaf3ded

Link:

https://www.unpac.me/results/d0ef0f55-5e19-468e-995e-235566fceae2/

Malware family:

XWorm

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c6b3670cddf9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ByteCode_MSIL_Backdoor_AsyncRAT Create hunting rule
Author:	ReversingLabs
Description:	Yara rule that detects AsyncRAT backdoor.

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	MALWARE_Win_AsyncRAT Create hunting rule
Author:	ditekSHen
Description:	Detects AsyncRAT

Rule name:	MALWARE_Win_XWorm Create hunting rule
Author:	ditekSHen
Description:	Detects XWorm

Rule name:	Multifamily_RAT_Detection Create hunting rule
Author:	Lucas Acha (http://www.lukeacha.com)
Description:	Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	Njrat Create hunting rule
Author:	botherder https://github.com/botherder
Description:	Njrat

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_DOTNET_PE_List_AV Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detecs .NET Binary that lists installed AVs

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	win_xworm_w0 Create hunting rule
Author:	jeFF0Falltrades
Description:	Detects win.xworm.

Rule name:	xworm Create hunting rule
Author:	jeFF0Falltrades

Rule name:	xworm_kingrat Create hunting rule
Author:	jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AsyncRAT

exe c6b3670cddf920fc00ea229582ee373eaf17a5aed181b85f8df54a571ddfba64

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/66302/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample