MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 18


Intelligence 18 IOCs YARA 24 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
SHA3-384 hash: aec281d1083a4f98945a2fd992bd20a1c56a2133b293d8621b152ddb795ab4b1b960ace970849e300b76df96e3fd22d1
SHA1 hash: c52191e7d504599583bd40a611a520f27a46ab37
MD5 hash: bf1c4f89d9f7477ffec951935e3740b1
humanhash: may-bluebird-fix-india
File name:d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:981'504 bytes
First seen:2025-10-09 14:00:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1895460fffad9475fda0c84755ecfee1 (341 x Formbook, 91 x AgentTesla, 56 x a310Logger)
ssdeep 24576:35EmXFtKaL4/oFe5T9yyXYfP1ijXdaO0h8m:3PVt/LZeJbInQRaO0
Threatray 749 similar samples on MalwareBazaar
TLSH T18A259E0273C1D062FFAB92734B5AF6115BBC79260123A62F13981D79BE701B1563E7A3
TrID 40.3% (.EXE) Win64 Executable (generic) (10522/11/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4504/4/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter adrian__luca
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
Verdict:
Malicious activity
Analysis date:
2025-10-09 14:02:55 UTC
Tags:
auto-startup xworm
Link:
https://app.any.run/tasks/2e8fa1dd-c3e4-458e-90ef-df32c3ed688c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
XWorm
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31330/
Detection(s):
SecuriteInfo.com.Win32.Trojan.Agent.35E5V6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e7c073277c2bd8bc5e5c50
Tags:
autorun autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a process from a recently created file
Launching a process
Сreating synchronization primitives
Connection attempt to an infection source
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug autoit cmdkey compiled-script fingerprint fingerprint keylogger lolbin microsoft_visual_cc msiexec packed
Link:
https://www.filescan.io/uploads/68e7c1423ec725b8760a8559/reports/5ebb85ad-347a-49ab-b003-78c14a7bb591/overview
Verdict:
Malicious
Labled as:
Trojan_Win32_AutoitInject_rfn
Link:
https://www.hybrid-analysis.com/sample/d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-17T02:06:00Z UTC
Last seen:
2025-10-08T06:57:00Z UTC
Hits:
~1000
Detections:
PDM:Trojan.Win32.Generic Backdoor.MSIL.XWorm.b Backdoor.Agent.TCP.C&C Trojan.Win32.Strab.sb HEUR:Trojan.Script.AUO.gen
Link:
https://opentip.kaspersky.com/d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9/results?tab=lookup
Malware family:
XWorm
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ee5f8085-f39b-4806-9eaf-912eef2080b8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9/
Verdict:
Malicious
Threat:
Family.XWORM
Link:
https://tip.neiki.dev/file/d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
Threat name:
Win32.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2025-09-17 05:08:48 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
26 of 36 (72.22%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22axulhaqe2nhbhjwcwn4ha5w7epcuib6xag26ocrihwr6fku64q._file
Verdict:
malicious
Label(s):
xworm
Create hunting rule
Similar samples:
5d118584433ca4dbbc4f97adf527e1bd820b93c391fe7a463e15c3f0abf7e394
AsyncRAT
b3454047b7a2a7e9542d7849dd6077373854338a8c10aff4e00f9a75cc1b751f
AsyncRAT
c9eafb27a205336cacc59320dc6679381efd45f51679072c961d34dd18cf6b38
AsyncRAT
+ 739 additional samples on MalwareBazaar
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:xworm discovery rat trojan
Link:
https://tria.ge/reports/251009-rdneratxcs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
System Location Discovery: System Language Discovery
AutoIT Executable
Suspicious use of SetThreadContext
Drops startup file
Executes dropped EXE
Detect Xworm Payload
Xworm
Xworm family
Malware Config
C2 Extraction:
198.12.126.169:8823
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0f5b58aa-072a-4635-83e0-2ee710982fce
Unpacked files
SH256 hash:
d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
MD5 hash:
bf1c4f89d9f7477ffec951935e3740b1
SHA1 hash:
c52191e7d504599583bd40a611a520f27a46ab37
Link:
https://www.unpac.me/results/a19b1b67-836a-4b58-83c5-a5f35bc5d61c/
SH256 hash:
7b2bfe80ae417cc04cdf908f9d1b386e389898435ebcd09823ef9d79b9ecb4fb
MD5 hash:
68b7d3e3aa24b417eec19a4a603347bb
SHA1 hash:
17d911df73ca4e7b027fa18e094d588f158916ae
Detections:
win_xworm_a0
Create hunting rule
win_xworm_w0
Create hunting rule
XWorm
Create hunting rule
win_mal_XWorm
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
MALWARE_Win_AsyncRAT
Create hunting rule
MALWARE_Win_XWorm
Create hunting rule
Link:
https://www.unpac.me/results/a19b1b67-836a-4b58-83c5-a5f35bc5d61c/
Parent samples :
8518f2dc1c6baecba153bac55e86dfa2ded08549eb8acae5b3967b9c2035f84e
d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6817a2ce08134d384e9b0acde1c1db7c8f15101f5c06d79c28a0f68f8aaa7b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:ByteCode_MSIL_Backdoor_AsyncRAT
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects AsyncRAT backdoor.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
Create hunting rule
Author:ditekSHen
Description:Detects Windows executables referencing non-Windows User-Agents
Rule name:MALWARE_Win_AsyncRAT
Create hunting rule
Author:ditekSHen
Description:Detects AsyncRAT
Rule name:MALWARE_Win_XWorm
Create hunting rule
Author:ditekSHen
Description:Detects XWorm
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:win_xworm_w0
Create hunting rule
Author:jeFF0Falltrades
Description:Detects win.xworm.
Rule name:xworm
Create hunting rule
Author:jeFF0Falltrades
Rule name:xworm_kingrat
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31330/

Comments