MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
SHA3-384 hash: 23effda4a6ff358e5b82e6c445502171f23df5c6f96c179bb54cfd426e3a5db8a427455bf910f861ad11b76df4feac91
SHA1 hash: 8862801d27cef0a719c68f407eec5c4895ef9f35
MD5 hash: c4075cc4bc0bfb318eb086f9eef71986
humanhash: hydrogen-fourteen-december-lithium
File name:ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:877'056 bytes
First seen:2026-03-06 15:34:18 UTC
Last seen:2026-03-06 16:30:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'845 x AgentTesla, 19'778 x Formbook, 12'302 x SnakeKeylogger)
ssdeep 12288:/jNiMwPeUP3jDdRMyCsuyBCWCPDFEGNMBvsaMPnjQd1EenBlLRNsn873eHl3nB5H:MFjZW5yjC+EaM/jGEEj1B73eD47
TLSH T1481502586618C812C4665B381AB2F37917789EEEE902F3179FCCBEF7B956B154C04283
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter adrian__luca
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
134
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/08bae3cc-6b1c-4dea-a3d1-876b0dfd9399/
Malware family:
n/a
ID:
1
File name:
ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
Verdict:
Malicious activity
Analysis date:
2026-03-06 10:37:13 UTC
Tags:
xworm
Link:
https://app.any.run/tasks/16679983-b4c8-4282-a0e1-5c3b29d2e48a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/56367/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.25561225.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
krypt packed
Link:
https://www.filescan.io/uploads/69aaf45b10e80629d4ffd30b/reports/63e6a6de-adb9-4528-8c98-2cc9de1a9ed6/overview
Verdict:
Malicious
Labled as:
Genie.8DN.Generic
Link:
https://www.hybrid-analysis.com/sample/ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
Verdict:
Malicious
File Type:
exe x32
Detections:
PDM:Worm.Win32.Generic PDM:Trojan.Win32.Generic Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb Trojan.MSIL.Agent.sb Backdoor.Agent.TCP.C&C Trojan.WinLNK.Agent.fb HEUR:Backdoor.MSIL.Remcos.gen Backdoor.MSIL.XWorm.b Backdoor.MSIL.XWorm.a
Link:
https://opentip.kaspersky.com/ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55/results?tab=lookup
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fdd86a5f-05da-40b3-9ca2-9d8e1abde3f7
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2026-02-26 00:56:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
23 of 36 (63.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zisd4fquqke3sc6lflxio3ku67xo3gl62ccxr6m5hmh5kjc4fjkq._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery rat trojan
Link:
https://tria.ge/reports/260306-sz8s9ahx6k/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Drops startup file
Executes dropped EXE
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
rency.ydns.eu:59013
wqo9.firewall-gateway.de:59013
code1.ydns.eu:59013
Unpacked files
SH256 hash:
ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
MD5 hash:
c4075cc4bc0bfb318eb086f9eef71986
SHA1 hash:
8862801d27cef0a719c68f407eec5c4895ef9f35
Link:
https://www.unpac.me/results/33cef5e4-bbd3-42ef-aa4d-bf493fb2f78e/
SH256 hash:
19014a290001ef2ea92a5f0bdeb5fefbb4aff3fcee0f22d397a36e42b86a1a86
MD5 hash:
17f859c4dbe30fbf2848b08806bbc7b8
SHA1 hash:
0a0d577cea8068438763097f4fc991c43eadaf6e
Link:
https://www.unpac.me/results/33cef5e4-bbd3-42ef-aa4d-bf493fb2f78e/
SH256 hash:
01f2eeb6d0dbcb225453e96e613815d990b0313cc316a1d0d2008c9907689f3e
MD5 hash:
c62e84c30924e6677964881327e9f9c0
SHA1 hash:
3f958e2439c0e12cc6d9cb1e8cb99c34ba15b79d
Detections:
SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/33cef5e4-bbd3-42ef-aa4d-bf493fb2f78e/
SH256 hash:
36aeaa9421322a433e362b755b3d3de2a7450399c2327718b991736458236677
MD5 hash:
241fce05fa2429fb88e613f72542481f
SHA1 hash:
652090f411be91cc5e1a13108ee2674826050487
Detections:
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
win_mal_XWorm
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_AsyncRAT
Create hunting rule
MALWARE_Win_XWorm
Create hunting rule
Link:
https://www.unpac.me/results/33cef5e4-bbd3-42ef-aa4d-bf493fb2f78e/
Parent samples :
897221ef7bedd400fc45ef4ebdb769c7993836942e77be5c5c34687eaf345bfc
1e92c5d7ad812ca338b0e85bf1decfa613ecb31376cf21888d45f474a06921af
fae06bd8e10ad8ce681b472be4e42c6f6370edb154f2ce85b1c84f12c1084470
ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe ca243e16148289b90bcb2aee876d54f7eeed997ed08578f99d3b0fd5245c2a55

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3657580/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/56367/

Comments