MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2
SHA3-384 hash: 748efc8f9065b8fb20f11d0890b7d5115e3c1c684fe1423ff93696d10915b5f89f05a5b29b34027462067223f692a26e
SHA1 hash: ced6f26a5054977d1bd463db15e1f968569936e1
MD5 hash: 1091bbbc88aad1130d4af2599b24bf36
humanhash: football-double-nebraska-sad
File name:e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:2'397'064 bytes
First seen:2026-03-22 15:20:13 UTC
Last seen:2026-03-22 16:55:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 74a352b7be38be736b4f1e0d51b66e8c (2 x AsyncRAT, 1 x CobaltStrike)
ssdeep 24576:IeaJNE7c3OyYTsJmyFIOi+1O7xG8zL1SlNHXxQNF9PAPtEGH5A9oV6FaTv8:/YO1TsJmvOiz7ZLit2NF9YPbH5ca78
TLSH T118B5BE92D3E844F1F0771F345C7987652EF6BC254EB4965F0286B60E2D33A854AB2B32
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:AsyncRAT exe RAT


Avatar
abuse_ch
AsyncRAT C2:
154.205.200.50:12356

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
154.205.200.50:12356 https://threatfox.abuse.ch/ioc/1773808/

Intelligence

File Origin
# of uploads :
2
# of downloads :
127
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Malware family:
asyncrat
Create hunting rule
ID:
1
File name:
e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2.exe
Verdict:
Malicious activity
Analysis date:
2026-03-22 15:05:46 UTC
Tags:
auto-sch auto-reg asyncrat donutloader loader
Link:
https://app.any.run/tasks/aaa3ae0d-8592-4873-8573-2b53325eb3f3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Win64.Malware-gen.72379899.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c00548390b99647412c1ae
Tags:
asyncrat autorun rozena spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Launching a process
Creating a process with a hidden window
Sending a custom TCP request
Сreating synchronization primitives
Connection attempt
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto dllhost evasive expired-cert expired-cert explorer fingerprint hacktool infdefaultinstall installer-heuristic invalid-signature keylogger lolbin microsoft_visual_cc overlay packed pcalua regedit rozena rundll32 runonce scriptrunner signed soft-404
Link:
https://www.filescan.io/uploads/69c008b74ec2f522cc52f867/reports/d5df55bc-036a-4c66-9ef4-bc546cb43950/overview
Verdict:
Malicious
Labled as:
Win64/GenKryptik_AGeneric.BCF trojan
Link:
https://www.hybrid-analysis.com/sample/e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2
Verdict:
Malicious
File Type:
exe x64
Detections:
Backdoor.Win64.Agent.sb Backdoor.MSIL.Crysan.c Trojan.Win32.Agent.sb Backdoor.MSIL.Crysan.sb Backdoor.MSIL.Crysan.d Backdoor.MSIL.Crysan.b Backdoor.MSIL.Agent.sb Trojan.Win64.Agentb.sb PDM:Trojan.Win32.Generic HEUR:Backdoor.MSIL.SheetRat.gen Trojan.Win32.Vimditator.sb Trojan.Win32.Shellcode.sb HEUR:Backdoor.Win64.Agent.gen
Link:
https://opentip.kaspersky.com/e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f76ce631-9676-4522-b380-f83489d8ae6e
Result
Threat name:
AsyncRAT, DonutLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1887333
Signature
Connects to many ports of the same IP (likely port scanning)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AsyncRAT
Yara detected DonutLoader
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1887333 Sample: e31681e2e236e4edaaafdb23c22... Startdate: 22/03/2026 Architecture: WINDOWS Score: 100 40 Suricata IDS alerts for network traffic 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 6 other signatures 2->46 7 e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51.exe 1 6 2->7         started        11 e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51.exe 4 2->11         started        14 e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51.exe 3 2->14         started        16 e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51.exe 3 2->16         started        process3 dnsIp4 36 154.205.200.77, 12356, 49693 IKGUL-26484US Seychelles 7->36 38 192.168.1.3, 12356 unknown unknown 7->38 48 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->48 50 Uses schtasks.exe or at.exe to add and modify task schedules 7->50 52 Unusual module load detection (module proxying) 7->52 18 schtasks.exe 1 7->18         started        34 e31681e2e236e4edaa...a2e4763ae51.exe.log, CSV 11->34 dropped 20 schtasks.exe 1 11->20         started        22 schtasks.exe 1 14->22         started        24 schtasks.exe 1 16->24         started        file5 signatures6 process7 process8 26 conhost.exe 18->26         started        28 conhost.exe 20->28         started        30 conhost.exe 22->30         started        32 conhost.exe 24->32         started       
Score:
56%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2/
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2
Threat name:
Win64.Trojan.Rozena
Create hunting rule
Status:
Malicious
First seen:
2026-03-22 15:05:50 UTC
File Type:
PE+ (Exe)
Extracted files:
245
AV detection:
7 of 36 (19.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4mlidyxcg3so3kvp3mr4eja7ghe2fzdwhlsrvk2yzh525mc3kpba._file
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:asyncrat family:donutloader botnet:laob execution loader persistence rat
Link:
https://tria.ge/reports/260322-sqx1dscx4r/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Async RAT payload
AsyncRat
Asyncrat family
Detects DonutLoader
DonutLoader
Donutloader family
Malware Config
C2 Extraction:
154.205.200.10:12356
154.205.200.50:12356
154.205.200.77:12356
Unpacked files
SH256 hash:
e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2
MD5 hash:
1091bbbc88aad1130d4af2599b24bf36
SHA1 hash:
ced6f26a5054977d1bd463db15e1f968569936e1
Link:
https://www.unpac.me/results/88aa44e0-f3e4-47f9-abbc-1889f84d3b54/
SH256 hash:
f303637fc0bd2ba64373e9034b07185b66de90d0138e9c005d93fa74532a178d
MD5 hash:
19eb0d76a4dd9af1add9a140a300863c
SHA1 hash:
d9e51b1edab0af2a27f6bf28f6b4a0819bb1ad29
Link:
https://www.unpac.me/results/88aa44e0-f3e4-47f9-abbc-1889f84d3b54/
Malware family:
AsyncRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e31681e2e236/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e31681e2e236e4edaaafdb23c2241f31c9a2e4763ae51aab58c9fbaeb05b53c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TH_APT_EquationGroup_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Equation Group (G0020) APT malware detection - covers EquationDrug, GrayFish, DoubleFantasy, TripleFantasy, Fanny, GROK, nls_933w HDD firmware module, and Shadow Brokers tooling
Reference:https://cyfare.net/
Rule name:TH_Generic_MassHunt_Win_Malware_2025_CYFARE
Create hunting rule
Author:CYFARE
Description:Generic Windows malware mass-hunt rule - 2025
Reference:https://cyfare.net/
Rule name:virustotal
Create hunting rule
Author:Tracel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/58689/

Comments