asyncrat | 6f4f68d9e1f782d2726434fc2882899b79eccc3916b7ef59f170cd1cf10387d6

Analysis

max time kernel
58s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f4f68d9e1f782d2726434fc2882899b79eccc3916b7ef59f170cd1cf10387d6.exe
Size 45KB
Sample260729-xrdqcsdc94
SHA256 6f4f68d9e1f782d2726434fc2882899b79eccc3916b7ef59f170cd1cf10387d6
MD5 12d89c57afebe40c6221e2d6e02aa905
SHA1 f5280424bf89fe33503ff95117f7c7839faf45b8
SHA512 0b4430e56e855afa6609d42d4fa913a1ebc86ab275bd01098f9d17331264197eaac65349d8fc5f6cf60fb7025199d3e60a52615966628e8f7cb815240fd6f859
SSDEEP 768:lu6XdTvER+SWUk6P4mo2qbEKjPGaG6PIyzjbFgX3iqP7zD6lsBDZWx:lu6XdTv2S2RKTkDy3bCXSqPeMdWx
TLSH
T1E1232B103BE88227F2BE4F78ACF26145467AF6A32603D6491CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

igop.top:443
igop.top:8443
igop.top:25
igop.top:80

Mutex

LtZ4SVTMWxiH

Attributes

delay
3
install
true
install_file
c168.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d00000001c5d9-10.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4668	cmd.exe
5704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f4f68d9e1f782d2726434fc2882899b79eccc3916b7ef59f170cd1cf10387d6.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2136	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5860	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\6f4f68d9e1f782d2726434fc2882899b79eccc3916b7ef59f170cd1cf10387d6.exe
"C:\Users\Admin\AppData\Local\Temp\6f4f68d9e1f782d2726434fc2882899b79eccc3916b7ef59f170cd1cf10387d6.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "c168" /tr '"C:\Users\Admin\AppData\Roaming\c168.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "c168" /tr '"C:\Users\Admin\AppData\Roaming\c168.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7536.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:4668
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2136
- - C:\Users\Admin\AppData\Roaming\c168.exe
    "C:\Users\Admin\AppData\Roaming\c168.exe"
    3⤵
    PID:4876

C:\Users\Admin\AppData\Roaming\c168.exe
"C:\Users\Admin\AppData\Roaming\c168.exe"
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7536.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7536.tmp.bat
Size 148B
SHA256 4e62c5eb6c783a1f85e849addda67c6fe2c4daf26ff762cddf4d86a5eb1abc59
MD5 69bb13d995a231db5ea4ddf6c7a6de30
SHA1 7474d0e261b8bf17618600569df4835f4993e58c
SHA512 99f71252c92b9fda0aa970c5b2ea2ceb93465ae674c9423cff25ea5fcb488768c385670e75f1a6e3f94f127b9e5baf0ed092fe2f1947b2e1e6e2200aaecbdd22
TLSH
T165C08C4251C6AA0E2805142302BAD48D92667C193E80BB50C304480D2280848F4A9281
MD5 SHA1 SHA512 TLSH

Submit Download

c168.exe

Path C:\Users\Admin\AppData\Roaming\c168.exe
Size 45KB
SHA256 6f4f68d9e1f782d2726434fc2882899b79eccc3916b7ef59f170cd1cf10387d6
MD5 12d89c57afebe40c6221e2d6e02aa905
SHA1 f5280424bf89fe33503ff95117f7c7839faf45b8
SHA512 0b4430e56e855afa6609d42d4fa913a1ebc86ab275bd01098f9d17331264197eaac65349d8fc5f6cf60fb7025199d3e60a52615966628e8f7cb815240fd6f859
SSDEEP 768:lu6XdTvER+SWUk6P4mo2qbEKjPGaG6PIyzjbFgX3iqP7zD6lsBDZWx:lu6XdTv2S2RKTkDy3bCXSqPeMdWx
TLSH
T1E1232B103BE88227F2BE4F78ACF26145467AF6A32603D6491CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3508-12-0x0000000074860000-0x000000007501C000-memory.dmp

Download

memory/3508-14-0x0000000074860000-0x000000007501C000-memory.dmp

Download

memory/4628-0-0x0000000074A62000-0x0000000074A63000-memory.dmp

Download

memory/4628-1-0x0000000000590000-0x00000000005A2000-memory.dmp

Download

memory/4628-2-0x0000000074A50000-0x000000007520C000-memory.dmp

Download

memory/4628-3-0x00000000050D0000-0x000000000516C000-memory.dmp

Download

memory/4628-8-0x0000000074A50000-0x000000007520C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads