asyncrat | 191ed0da8d313d6e48bbdfb0ef0cb5210948a778ea8e4ec87863a6febd588fec

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mko1.exe
Size 45KB
Sample260814-c8rnbsbl31
SHA256 191ed0da8d313d6e48bbdfb0ef0cb5210948a778ea8e4ec87863a6febd588fec
MD5 19dde6aedfe451215d10788c0bd39908
SHA1 b8356147ccef462eb24746d784f8f40cb804404b
SHA512 16657bdbf5460fbd14396d57aac0abb41fc24332b7cc3dafb2d4f6c50a659497a6cd02f998bbbbe1b2d1f44c89da6f08b5d6a275d295013aca5e92ca5d668990
SSDEEP 768:suhgJTP0FU0WU2j2Cmo2qVIqyE0OFUwdexIkDPIdzjb0gX3iZJ6QjRTp1VBDZkx:suhgJTPOY2BqNTwMd3bbXSX6uT17dkx
TLSH
T127232A0037E9C22BF2BE4F7469F26141867AF6632603D6491CC451DB5B23BC6DA426EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

watchfriendsonline.co/vi-vn/:80
watchfriendsonline.co/vi-vn/:8080
watchfriendsonline.co/vi-vn/:443
watchfriendsonline.co/vi-vn/:8443
watchfriendsonline.co/vi-vn/:6606
watchfriendsonline.co/vi-vn/:22
tutoriapps.net/:80
tutoriapps.net/:8080
tutoriapps.net/:443
tutoriapps.net/:8443
tutoriapps.net/:6606
tutoriapps.net/:22
vodka-fun.buzz/:80
vodka-fun.buzz/:8080
vodka-fun.buzz/:443
vodka-fun.buzz/:8443
vodka-fun.buzz/:6606
vodka-fun.buzz/:22
lyricsglory.in/:80
lyricsglory.in/:8080
lyricsglory.in/:443
lyricsglory.in/:8443
lyricsglory.in/:6606
lyricsglory.in/:22
crow789slot.co/:80
crow789slot.co/:8080
crow789slot.co/:443
crow789slot.co/:8443
crow789slot.co/:6606
crow789slot.co/:22
hashlucky777.io/:80
hashlucky777.io/:8080
hashlucky777.io/:443
hashlucky777.io/:8443
hashlucky777.io/:6606
hashlucky777.io/:22
789winbar.com/:80
789winbar.com/:8080
789winbar.com/:443
789winbar.com/:8443
789winbar.com/:6606
789winbar.com/:22
789win01.dev/:80
789win01.dev/:8080
789win01.dev/:443
789win01.dev/:8443
789win01.dev/:6606
789win01.dev/:22

Mutex

Eer5AzcVy5Bg

Attributes

delay
3
install
false
install_file
GoogleUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mko1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	mko1.exe
Token: SeDebugPrivilege	944	mko1.exe

C:\Users\Admin\AppData\Local\Temp\mko1.exe
"C:\Users\Admin\AppData\Local\Temp\mko1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-0-0x0000000074A22000-0x0000000074A23000-memory.dmp

Download

memory/944-1-0x0000000000FB0000-0x0000000000FC2000-memory.dmp

Download

memory/944-2-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

memory/944-3-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Download

memory/944-4-0x0000000005F20000-0x0000000005FBC000-memory.dmp

Download

memory/944-5-0x0000000074A22000-0x0000000074A23000-memory.dmp

Download

memory/944-6-0x0000000074A10000-0x00000000751CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads