MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d34d1b55201f0318e0fd5a7cd4feacff0edb825e57d45ea9507f1d06303ff97c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 12 File information Comments

SHA256 hash:	d34d1b55201f0318e0fd5a7cd4feacff0edb825e57d45ea9507f1d06303ff97c
SHA3-384 hash:	f602f261389990740bf0ca1f2bc4ee5ad9bf8fee47267bbce0da3b776bdeff419132dc2c96a232460994b15a9fd3f046
SHA1 hash:	d9e5cb0b4086ece2f1666a146682d9d16789f03e
MD5 hash:	b062484550d2ebf1ce8302417c0ff716
humanhash:	white-fanta-louisiana-sad
File name:	llImges_AngelaWhite-Albomghrvy.zip
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	493'858 bytes
First seen:	2026-09-22 07:21:09 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:UnL36rrXKULp4SYxNQA4Q8PtE5aCyq93DvUrA4eQVU:vrjRF4S+tp8PW5arY3DH
TLSH	T1ACB423EEC34B61188407DD736F65E82A5A9B1EE07FC98DC12A35774278C436BADE21C4
Magika	zip
Reporter	smica83
Tags:	AsyncRAT zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	llImges_AngelaWhite-Albomghrvy.js
File size:	52'529 bytes
SHA256 hash:	d4c7005a3cc013589a54aca82518da18461985944145493834501b6fbda2b8a5
MD5 hash:	84c52e3059e6f82066c5731f78164bcc
MIME type:	text/plain
Signature	AsyncRAT

File name:	+
File size:	500'928 bytes
SHA256 hash:	0c2d38e4390acf92b34f3de288d4ae1baefa933ffa3e75450dea87498b545ede
MD5 hash:	58a237e755e3e45016bcf0f99d1291d2
MIME type:	application/x-dosexec
Signature	AsyncRAT

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/d1421b49-adf5-4aea-9fc5-e4f1e8942303/

Detection(s):

SecuriteInfo.com.FileRepMalware.92369378.UNOFFICIAL

Verdict:

Unknown

Threat level:

n/a -.1.0/10

Confidence:

100%

Tags:

adaptive-context expired-cert installer installer installer-heuristic microsoft_visual_cc overlay packed packed packed packer reconnaissance self-signed-cert sfx short-lived-cert signed upx

Link:

https://www.filescan.io/uploads/6ab22c6b8b3b2f594647354b/reports/7d512ba5-0944-44e9-bb9b-09bab32efd4f/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d34d1b55201f0318e0fd5a7cd4feacff0edb825e57d45ea9507f1d06303ff97c

Score:

Verdict:

Benign

File Type:

Result

Malware family:

asyncrat

Score:

10/10

Tags:

family:asyncrat botnet:mixerxxxxx discovery execution rat spyware stealer upx

Link:

https://tria.ge/reports/260922-kes83axshy/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Reads user/profile data of web browsers

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Executes dropped EXE

Loads dropped DLL

UPX packed file

Malware Config

C2 Extraction:

spongebob.dynuddns.com:6060

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.68

Link:

https://yomi.yoroi.company/submissions/d34d1b55201f0318e0fd5a7cd4feacff0edb825e57d45ea9507f1d06303ff97c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	UPX20030XMarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_3 Create hunting rule
Author:	Kevin Falcoz
Description:	UPX 3.X

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample