MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AsyncRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f
SHA3-384 hash:	2a8ac7610469b88608568ca5666ff19042765add36626a8e714d5f181766c5cbe8dccc1b1e7294f78cf0cfd2282e6496
SHA1 hash:	172a7bfb9eedb8b7c18ea7186309f013944caa75
MD5 hash:	4a654205ddda5187ea3bf4b03074e4d2
humanhash:	tennis-iowa-one-nuts
File name:	cs2.exe
Download:	download sample
Signature	AsyncRAT Create hunting rule
File size:	107'832 bytes
First seen:	2026-08-30 23:43:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2ed2f81f89a1bf1f161dc30df28cef9a (1 x AsyncRAT)
ssdeep	1536:078EQgoMNcjwGzlAbBbqfSpApMjY9WgWWlfSqyTX56+UzAP3vaqtVY7PJhMpPcv:cQT3lAbBbRpA+TgWqd69Uz8vTtViJh06
TLSH	T1CDB3F107F30A0652DD2AA272D089C4F3F770CFC912215D7D992B99242667B926B3A35F
TrID	21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 21.2% (.EXE) Win64 Executable (generic) (6522/11/2) 16.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 14.6% (.EXE) Win32 Executable (generic) (4504/4/1) 6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
Reporter	BlinkzSec
Tags:	AsyncRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

dcrat

ID:

File name:

http://118.107.6.183/cs2.exe

Verdict:

Malicious activity

Analysis date:

2026-08-30 23:41:58 UTC

Tags:

dcrat rat donutloader loader asyncrat

Link:

https://app.any.run/tasks/12a1053f-1dc2-4b9b-921e-97fd1088ac2d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DCRat

Link:

https://www.capesandbox.com/analysis/83367/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connection attempt

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug expired-cert invalid-signature packed signed

Link:

https://www.filescan.io/uploads/6a94c1b7ffc0e45159c3e0ad/reports/e88466ab-b9b7-4c0d-97d7-dfa6dca55a3d/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f

Malware family:

Kazuar

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d3f7a823-e929-42ac-a0ab-475b3ecbe411

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/4a654205ddda5187ea3bf4b03074e4d2

Detection:

dcrat

Link:

https://mwdb.cert.pl/sample/f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6335xvswdz7onot6nk773mpf3ya36uitdcvn4neclwei5go3mrpq._file

Verdict:

malicious

Label(s):

AsyncRAT

DonutLoader

Link:

https://reports.threatray.com/d87c2115-9230-4053-b07f-3bec52d4ad6e

Result

Malware family:

donutloader

Score:

10/10

Tags:

family:asyncrat family:donutloader botnet:default discovery loader persistence rat

Link:

https://tria.ge/reports/260830-3qpdcsbl6v/

Behaviour

Suspicious use of AdjustPrivilegeToken

System Location Discovery: System Language Discovery

Adds Run key to start application

Async RAT payload

Detects DonutLoader

Family: AsyncRat

Family: DonutLoader

Malware Config

C2 Extraction:

112.213.103.17:1217

Unpacked files

SH256 hash:

f6f7dbd6561e7ee6ba7e6abffdb1e5de01bf511318aade34825d888e99db645f

MD5 hash:

4a654205ddda5187ea3bf4b03074e4d2

SHA1 hash:

172a7bfb9eedb8b7c18ea7186309f013944caa75

Link:

https://www.unpac.me/results/a7337620-107e-40a3-b7a1-2651687742b9/

SH256 hash:

8e07ec3b2017e3be75d8d3d56a847f705ac6389427471ed52481cef870351600

MD5 hash:

f97e8e725a3ac3ee1ab276e169d5e20d

SHA1 hash:

12ca267a91b0dcc8ed9d67023c104d479355e9a7

Detections:

AsyncRAT

DCRat

INDICATOR_SUSPICIOUS_EXE_DcRatBy

INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

win_asyncrat_unobfuscated

Link:

https://www.unpac.me/results/a7337620-107e-40a3-b7a1-2651687742b9/

Malware family:

DonutLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f6f7dbd6561e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.