MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dca7ccbbc30a735e43904ad1c14de1cb75da21f1d9b0adac7b9cbeb33bd3de1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 7 File information Comments

SHA256 hash:	dca7ccbbc30a735e43904ad1c14de1cb75da21f1d9b0adac7b9cbeb33bd3de1e
SHA3-384 hash:	287c8ac42da3df64ea35222861c65f9216c6ee7d981762d2db27110a25b53eeb1625bb22559f4a1067873147dec76705
SHA1 hash:	511d237b851c0ebbdf1d750252d1b47cd3d03094
MD5 hash:	eb96f7594f33d30d98bb61ae1d586102
humanhash:	uranus-video-blossom-seven
File name:	osint_tools.rar
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	159'819 bytes
First seen:	2025-10-24 19:31:48 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:s94S4jhbG8inxjMpXTcWmPOuadiZIAXS5fhVGEbdl81KwfM1aMQWMNuAF:c4FXixjEdmGuadNAX+fPdl74M1zQLNd
TLSH	T19BF312968165CE99C22D5453BC2C3B4A5B0282329E6F81BAF40D91B703BBFDF754AD1C
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	burger
Tags:	AsyncRAT CVE-2025-6218 CVE-2025-8088 rar

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:	osint tools 2025.txt
File size:	1'779 bytes
SHA256 hash:	6a381e08cc856d9f01161e8a1a03f99e8302f6beca1b77396cd7a26abaaa806b
MD5 hash:	d166868ce7a695e9615c47958f194c5f
MIME type:	text/plain
Signature	AsyncRAT

File name:	osint tools 2025.txt:.._.._.._.._.._.._AppData_Roaming_Microsoft_Windows_Start Menu_Programs_Startup_312312ea.bat
File size:	727'814 bytes
SHA256 hash:	e4440f5bbcfad7750e98f84c6331da9cab4cfda23e93267e79611d45532efece
MD5 hash:	f8214e0ce04a48b8cb3a17fe9dc19897
MIME type:	text/x-msdos-batch
Signature	AsyncRAT

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilRAR.GhettoSuperstream.20241120.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68fbd45d6c859164aa640b54

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint

Link:

https://www.filescan.io/uploads/68fbd4563a79800405f54dbb/reports/c81fa41e-2959-4717-88f9-551889b68b75/overview

Verdict:

Malicious

Labled as:

CVE-2025-8088

Link:

https://www.hybrid-analysis.com/sample/dca7ccbbc30a735e43904ad1c14de1cb75da21f1d9b0adac7b9cbeb33bd3de1e

Verdict:

Malicious

File Type:

rar

First seen:

2025-10-17T12:49:00Z UTC

Last seen:

2025-10-24T16:47:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.BAT.Cobalt.gen HEUR:Exploit.Multi.CVE-2025-8088.gen HEUR:Exploit.Multi.CVE-2025-6218.b

Link:

https://opentip.kaspersky.com/dca7ccbbc30a735e43904ad1c14de1cb75da21f1d9b0adac7b9cbeb33bd3de1e/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dca7ccbbc30a735e43904ad1c14de1cb75da21f1d9b0adac7b9cbeb33bd3de1e/

Verdict:

Malicious

Threat:

Exploit.Multi.CVE-2025-6218

Link:

https://tip.neiki.dev/file/dca7ccbbc30a735e43904ad1c14de1cb75da21f1d9b0adac7b9cbeb33bd3de1e

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-10-16 15:37:16 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3st4zo6dbjzv4q4qjli4ctpbzn25uipr3gyk3ld3ts7lgo6t3ypa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dca7ccbbc30a735e43904ad1c14de1cb75da21f1d9b0adac7b9cbeb33bd3de1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Base64_Encoded_Powershell_Directives Create hunting rule

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	SUSP_Base64 Create hunting rule
Author:	Eslam Hassan
Description:	Detects hex encoded code that has been base64 encoded
Reference:	Internal Research

Rule name:	SUSP_RAR_NTFS_ADS Create hunting rule
Author:	Proofpoint
Description:	Detects RAR archive with NTFS alternate data stream
Reference:	https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WinRAR_CVE_2025_8088_Exploit Create hunting rule
Author:	marcin@ulikowski.pl
Description:	Detects RAR archives exploiting CVE-2025-8088 in WinRAR
Reference:	https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/