MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d49af631d0fd3acbdaf7cdd6e6d30ea162c4f1ead48221e86dbe0d2c1e59e11c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d49af631d0fd3acbdaf7cdd6e6d30ea162c4f1ead48221e86dbe0d2c1e59e11c
SHA3-384 hash:	25a2ad9c5639a4dd2d78fd5fcd7c324eadca2b74dcb62ac5b7d0c071623a9b61e53aa351cff11ee0d725ee0dee2be76e
SHA1 hash:	7005d3c408d601b960ec18435622789da2a946ca
MD5 hash:	54611d08b7476b84d84744fe62958407
humanhash:	golf-paris-carpet-fix
File name:	cmd.bat
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	172 bytes
First seen:	2025-04-09 07:05:01 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	3:mKDDGKSSJJFI9IrFhjNBtAcHfD5uVilZGZELBCTYLISG63BjUJCI6B:hSG8qXHHfD5uVirGWoTCIsjUJkB
Threatray	69 similar samples on MalwareBazaar
TLSH	T194C0803F5154CB261505E475F6160945F14D39C500F55F527272AD124571554D5580C8
Magika	batch
Reporter	JAMESWT_WT
Tags:	185-7-214-181 AsyncRAT bat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

108

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN asyncrat

Malware family:

asyncrat

Alert

Create hunting rule

ID:

1

File name:

cmd.bat

Verdict:

Malicious activity

Analysis date:

2025-04-09 09:14:34 UTC

Tags:

loader rat asyncrat remote

Link:

https://app.any.run/tasks/5445f95f-3b64-4fb2-8444-56018a36525c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f61e4371beff15dccd9db6

Tags:

trojan shell sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Сreating synchronization primitives

Creating a file in the %temp% subdirectories

Creating a process with a hidden window

Creating a file

Connection attempt to an infection source

Sending a TCP request to an infection source

Sending an HTTP GET request to an infection source

Unauthorized injection to a system process

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive powershell

Link:

https://www.filescan.io/uploads/67f61c2440adfb5162bd1b12/reports/ef00a0e0-351e-4661-bc6a-9eb51cb3f3a1/overview

Hybrid Analysis BZC.PZQ.Boxter.1128

Verdict:

Malicious

Labled as:

BZC.PZQ.Boxter.1128

Link:

https://www.hybrid-analysis.com/sample/d49af631d0fd3acbdaf7cdd6e6d30ea162c4f1ead48221e86dbe0d2c1e59e11c

Joe Sandbox AsyncRAT, DcRat

Result

Threat name:

AsyncRAT, DcRat

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1660452

Signature

Antivirus detection for dropped file

Compiles code for process injection (via .Net compiler)

Found malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected AsyncRAT

Yara detected Costura Assembly Loader

Yara detected DcRat

Yara detected Powershell download and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d49af631d0fd3acbdaf7cdd6e6d30ea162c4f1ead48221e86dbe0d2c1e59e11c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d49af631d0fd3acbdaf7cdd6e6d30ea162c4f1ead48221e86dbe0d2c1e59e11c/

ReversingLabs TitaniumCloud Script-BAT.Trojan.Boxter

Threat name:

Script-BAT.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-24 16:54:00 UTC

File Type:

Text (Batch)

AV detection:

7 of 36 (19.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2snpmmoq7u5mxwxxzxlonuyoufrmj4pk2sbcd2dnxygsyhsz4eoa._file

Threatray asyncrat boratrat

Verdict:

malicious

Label(s):

asyncrat

Alert

Create hunting rule

boratrat

Alert

Create hunting rule

Similar samples:

0f1073c5cacf5009f6097cf771b71ab18e3350fd445935ce72ac1b45fd175291

AsyncRAT

2934a9348fe15bcc85228667593a6e5ce0a4b831ce481b290c1ba7ebeb907c20

AsyncRAT

3b1a7f4151f967d6574f3c26de9eba9745123e19b61bfb6d5494c2a777da8a21

AsyncRAT

440c3df99e39d7adbbd231ab92b01c2e70e276703e8b5831822bba1facc7e1b9

AsyncRAT

8d23a79b7608c65d0444b2fe8c31d766d57940401cd4904f9594d9bb006ce144

AsyncRAT

927dedee3e4382a8aba77ee2322bb9aead633344f8cdccec0ce4c5e19fddb5b8

AsyncRAT

ea09ce7cfee9dd88c2bd0bd54ad9144ecbcba2fbb3c7fe5189877c236467ec8e

AsyncRAT

error

AsyncRAT

+ 59 additional samples on MalwareBazaar

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default discovery execution rat

Link:

https://tria.ge/reports/250409-hwk8nssybx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Downloads MZ/PE file

AsyncRat

Asyncrat family

Malware Config

C2 Extraction:

185.7.214.181:1414

Dropper Extraction:

http://185.7.214.181/a.mp4

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d49af631d0fd3acbdaf7cdd6e6d30ea162c4f1ead48221e86dbe0d2c1e59e11c