Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/07/2026, 15:23
General
- Target AsyncClient.exe
- Size 68KB
- Sample260719-sshcqadv6r
- SHA256 5a5b2caad36a0b5fec41b48de6446fa1053d326ef4ba5c2efd9aea205b44b5de
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
AWS | 3Losh
Botnet
-
Default
C2
-
176.177.137.52:6606
-
176.177.137.52:7707
-
176.177.137.52:8808
-
176.177.137.52:4444
Mutex
-
AsyncMutex_alosh
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
-
local_host
127.0.0.1
aes.plain
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zffxnulw.dii.ps1
memory/1568-0-0x000001E01F060000-0x000001E01F078000-memory.dmp
memory/1568-8-0x000001E039490000-0x000001E0394A0000-memory.dmp
memory/1568-9-0x000001E039440000-0x000001E039462000-memory.dmp
memory/1568-10-0x000001E039490000-0x000001E0394A0000-memory.dmp