asyncrat | 7955bbdc1d94038940aa37a41a218869f1d301092d363930ad2f17b512d8a386

Analysis

max time kernel
60s
max time network
56s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MiraiBot.exe
Size 47KB
Sample260831-va3l2sdl21
SHA256 7955bbdc1d94038940aa37a41a218869f1d301092d363930ad2f17b512d8a386
MD5 400efa5f4a9df220b82c767f10bfc376
SHA1 c81143ef85000dde0daeb5d211a0328356a76962
SHA512 b0bd0a3c679ca137a13227d888ddbf3c952112e25bd775c9913fca4958069f6d1e66663a7de5a598375306ab6abb2a594b7c50231463a6c0f1fe494032e27cdd
SSDEEP 768:UuIHdTYEXlTWU/+qhmo2qb60lNMWiAXau8/14xIPIEaPWYj40b+O4OypuLlItM0P:UuIHdTYUN2ON9Xav/q7Ea+YPb+1pKvoF
TLSH
T12A232C003BE9822BF2BE5F7499F26245867BB2637603D54D2CC451D75B13BC28A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vdubprint.co defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

vdubprint.co

vdubprint.co:80
vdubprint.co:8080
vdubprint.co:443
vdubprint.co:8443
vdubprint.co:22
vdubprint.co:23
vdubprint.co:6606
vdubprint.co:5555

Mutex

p7dK7XgHckO8

Attributes

delay
3
install
true
install_file
GoogleUpdate.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000000441-11.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3760	cmd.exe
6120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MiraiBot.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4936	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4764	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\MiraiBot.exe
"C:\Users\Admin\AppData\Local\Temp\MiraiBot.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdate" /tr '"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdate" /tr '"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp792E.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:6120
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4936
- - C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
    "C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"
    3⤵
    PID:3156

C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
"C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe"
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp792E.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp792E.tmp.bat
Size 156B
SHA256 2a8b66d67bd18b16a4fd611aa212d3188f90fb17289f27d2abb934fc8a24bc65
MD5 d56260d0f7ddd0fb06a063b293b77933
SHA1 3be9cd806e1efeb841e873b50ee4790038d5defb
SHA512 950e83bef5367dfa8ed5276fabc6b10d3beeda4dde7e242a98e8b98b819886876f32741c21f3e6bb2c482908dbe9e01685e07ee8a9f2b38c8809c1657133cd63
TLSH
T1C5C02B5361C9FA1F2805B81713FED8CD91B66C593F44BB00C704401D22C0898F8ED382
MD5 SHA1 SHA512 TLSH

Submit Download

GoogleUpdate.exe

Path C:\Users\Admin\AppData\Roaming\GoogleUpdate.exe
Size 47KB
SHA256 7955bbdc1d94038940aa37a41a218869f1d301092d363930ad2f17b512d8a386
MD5 400efa5f4a9df220b82c767f10bfc376
SHA1 c81143ef85000dde0daeb5d211a0328356a76962
SHA512 b0bd0a3c679ca137a13227d888ddbf3c952112e25bd775c9913fca4958069f6d1e66663a7de5a598375306ab6abb2a594b7c50231463a6c0f1fe494032e27cdd
SSDEEP 768:UuIHdTYEXlTWU/+qhmo2qb60lNMWiAXau8/14xIPIEaPWYj40b+O4OypuLlItM0P:UuIHdTYUN2ON9Xav/q7Ea+YPb+1pKvoF
TLSH
T12A232C003BE9822BF2BE5F7499F26245867BB2637603D54D2CC451D75B13BC28A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-0-0x0000000074A82000-0x0000000074A83000-memory.dmp

Download

memory/936-1-0x00000000002A0000-0x00000000002B2000-memory.dmp

Download

memory/936-2-0x0000000074A70000-0x000000007522C000-memory.dmp

Download

memory/936-3-0x0000000002A30000-0x0000000002A96000-memory.dmp

Download

memory/936-4-0x0000000005230000-0x00000000052CC000-memory.dmp

Download

memory/936-9-0x0000000074A70000-0x000000007522C000-memory.dmp

Download

memory/4240-13-0x0000000074870000-0x000000007502C000-memory.dmp

Download

memory/4240-15-0x0000000074870000-0x000000007502C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads