MALICIOUS — 0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9.exe

MALICIOUS — 0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AsyncRAT family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9
SHA-1: e728a6a5c5b29ea0e1355639a1ee577edf2eb443
MD5: c85212d823d9412cb8eeec70e5145947
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 393216:8ARzkO93kHxQMc4lfl8UxgmSJEB/3NOg7KEl8KFkbSRAyHxyYMKNAVUzXj:DzbUHx7l9vSJkVJFkmRyYMcAE
TLSH: T18C73338F32F11CA5D1E6C70C7F0ED27E14E5849E27F4A90278423608E58986FFB4A956
Submitted as: 0ce366b7463e6b3c9d389d1c799c9b64219e71112f13568e5e16efbfbebf9da9.exe
File type: pe · Size: 21547520 bytes
Verdict: malicious (100/100) · Family: AsyncRAT

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Trojan:MSIL/XWormRAT!atmn
Emsisoft (Emergency Kit): Gen:Variant.AsyncRAT.382
Trellix Stinger (McAfee): Trojan-JARL!C85212D823D9
Kaspersky (KVRT): UDS:Trojan-PSW.Win64.Salat

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (0A03EE6B): 0bc0690af21f80e752996d71cefba04c35aa48c52515853243d80b11a2f2a94b - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 936) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:MSIL/XWormRAT!atmn (rule Trojan:MSIL/XWormRAT!atmn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.AsyncRAT.382 (rule Gen:Variant.AsyncRAT.382) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-JARL!C85212D823D9 (rule Trojan-JARL!C85212D823D9) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-PSW.Win64.Salat (rule UDS:Trojan-PSW.Win64.Salat) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 46 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted Salat config (0 C2) - engine signal, weight 0.45, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13270 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9528/files/0bc0690af21f80e752996d71cefba04c35aa48c52515853243d80b11a2f2a94b - 0bc0690af21f80e752996d71cefba04c35aa48c52515853243d80b11a2f2a94b
/opt/CAPEv2/storage/analyses/9528/files/cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b - cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
/opt/CAPEv2/storage/analyses/9528/files/2d56b1968b3b153f5c77d8697b1cb805d95094ee24286e69586d869d9a099496 - 2d56b1968b3b153f5c77d8697b1cb805d95094ee24286e69586d869d9a099496
/opt/CAPEv2/storage/analyses/9528/files/d397dfa59d5c3068393ecc6ca49605de32395f0cd0dbf9d305d6e9c0491a479b - d397dfa59d5c3068393ecc6ca49605de32395f0cd0dbf9d305d6e9c0491a479b
62679ef50d946289f7aeaa95d942b6fe31cf8749f38c751260d7401a83cab295 - 62679ef50d946289f7aeaa95d942b6fe31cf8749f38c751260d7401a83cab295

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786419220&P2=404&P3=2&P4=F16Vu0WA2YL2dFVnvjtXX7l7op6ndfztGoWUdi9%2ffMGdWQTLvcFoVlAKpcxdzR7BQPkY6nnUu8T2jz6pmZpi%2fw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786419274&P2=404&P3=2&P4=XZEz3Q0f%2b0kbCWqKdy%2bDi5TUp9wDQt7ZwA6wx4AG3RYeQFtm25jWtpvQ7zJGEQ%2f8hnXwM0Mg9tcUwFaQaRW%2bpg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://secure.globalsign.com/cacert/root-r3.crt

Embedded domains

e.kr
jd.de
5t.ir
b.jp
72.be
dns.google
ton.access.orbs.network
tonapi.io
sa1atik.cn

Embedded IP addresses

51.132.193.105
20.247.184.142
20.247.184.197
4.230.171.124
57.154.63.210
74.179.77.204
74.179.77.164
4.150.223.96
74.178.76.44
203.26.79.13
172.178.240.161
20.42.73.28
20.42.65.89
135.234.160.246
72.145.35.114
104.18.20.226
104.18.34.88
2.59.219.233
52.148.114.188
104.21.92.198
104.16.248.249
172.67.149.80
172.64.153.168
104.21.81.197
168.222.202.171

File paths

B:\vhZ
e:\l
d:\_
T:\a
K:\6g
p:\}
t:\U_
W:\:t
k:\T
T:\M
q:\2tV

More AsyncRAT samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report