MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df8d8ecad3dc7a9264174282acdf4175951e0365111b472f4434f87fc0dd7efc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	df8d8ecad3dc7a9264174282acdf4175951e0365111b472f4434f87fc0dd7efc
SHA3-384 hash:	25e1944514211d4f52e980083a4e77d5815f54f48d8174dea4efbeaa9a4ee9149f100021c3b05e2767d224cea43d0171
SHA1 hash:	1920029f12209e4d1b3141551b5e729dffa50f56
MD5 hash:	44eed64e278f2dd7714805ff5dff2dc5
humanhash:	washington-white-mobile-item
File name:	UKE1.bat
Download:	download sample
Signature	AsyncRAT Alert Create hunting rule
File size:	2'270 bytes
First seen:	2026-01-20 20:01:23 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	48:1o/BfScAObEpEu+3tj0udzokhinkkPxJe1CdJ1/pHhBaJr:1o/nEGXj2khikkPxQ1C1pHhEZ
Threatray	337 similar samples on MalwareBazaar
TLSH	T1104132421CD562324136C777B2544199F95A238B0F41E6CD7A9281CD2F5D2D3CFDF986
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	batch
Reporter	Anonymous
Tags:	AsyncRAT bat

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

292

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN asyncrat

Malware family:

asyncrat

Alert

Create hunting rule

ID:

1

File name:

Transaction_copy.pdf.zip

Verdict:

Malicious activity

Analysis date:

2026-01-19 09:18:25 UTC

Tags:

webdav arch-exec arch-doc python asyncrat rat remote dcrat darkcrystal xworm

Link:

https://app.any.run/tasks/e9139c15-b116-4864-ae39-d870989353de

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/49571/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.BadBatObs.31934.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=696fdf63bcad3327ec06f38a

Tags:

autorun dropper shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm cscript evasive explorer fingerprint lolbin obfuscated timeout wscript

Link:

https://www.filescan.io/uploads/696fdf415db9ae47708ab780/reports/f1815786-e48a-4839-bb35-1ec6bf34586a/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/df8d8ecad3dc7a9264174282acdf4175951e0365111b472f4434f87fc0dd7efc

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-20T17:24:00Z UTC

Last seen:

2026-01-22T03:13:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.BAT.Alien.gen

Link:

https://opentip.kaspersky.com/df8d8ecad3dc7a9264174282acdf4175951e0365111b472f4434f87fc0dd7efc/results?tab=lookup

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df8d8ecad3dc7a9264174282acdf4175951e0365111b472f4434f87fc0dd7efc/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/df8d8ecad3dc7a9264174282acdf4175951e0365111b472f4434f87fc0dd7efc

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-01-20 19:55:05 UTC

File Type:

Text (Batch)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=36gy5swt3r5jezaxikbkzx2bowkr4a3fcenuol2egt4h7qg5p36a._file

Threatray unc_loader_078 asyncrat resolverrat xworm donutloader

Verdict:

malicious

Label(s):

unc_loader_078

Alert

Create hunting rule

asyncrat

Alert

Create hunting rule

resolverrat

Alert

Create hunting rule

xworm

Alert

Create hunting rule

donutloader

Alert

Create hunting rule

Similar samples:

534b8130a00712c5ecc8a0bfd19c89657c69d519d2fa02e889bc9ba415732cd6

AsyncRAT

7b910a8a522431771087495724fb30ee1620d2490fb5aa7e77ba9114545a05ea

AsyncRAT

9f8033bf9e669aa8043f46733f73dd933ebe06eb4bbf7b3ccef3520bf4921598

AsyncRAT

a70129ec6f019339caa01a1cddc49494b87285a7b51bf0f4a2934d55c413e2ce

AsyncRAT

b1b4ffcd21342c7de7f0bc286eb3f4ec6a5b919df5f20d383b4df0bd462cbe48

AsyncRAT

b2a203b9391987049ad60c826e6d7a76554f38dfc8b9ce88fea083ca1b106800

AsyncRAT

c11d635651a84fd8d64af5024af9d691bb790938c07a6bf1521c1ba54b734a0a

AsyncRAT

d42b3db1a4f5233ab5e2c1605d3ee3c94983cd7241f42602a1f10fad754cb2f2

AsyncRAT

error

AsyncRAT

f545d644196419b41eadae3f0846888c396284cc148c780916c0d96a07f71b40

AsyncRAT

f97a6429797b77f052c74788515669857c47e4273fa01d5eebb39024d639ba49

AsyncRAT

+ 327 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion

Link:

https://tria.ge/reports/260120-yr36pahx2f/

Behaviour

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Drops startup file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.23

Link:

https://yomi.yoroi.company/submissions/df8d8ecad3dc7a9264174282acdf4175951e0365111b472f4434f87fc0dd7efc

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/49571/