asyncrat | 58b3a8f4827e858003f74cb3528a08b4bce190e362a7177a2727e1a9ec3e7b87

Analysis

max time kernel
60s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58b3a8f4827e858003f74cb3528a08b4bce190e362a7177a2727e1a9ec3e7b87.exe
Size 111KB
Sample261002-x2xk8azthy
SHA256 58b3a8f4827e858003f74cb3528a08b4bce190e362a7177a2727e1a9ec3e7b87
MD5 3a18f06ffc1a04e66db8cecafab915de
SHA1 425492012921b3d16c8b72604ab6a344aed03291
SHA512 434c6afeeb182ee3c64bf4b373a81d3d928991cadaa4bad098e01baf403e30c121a512380a540637275116123e67247b1db9ff501c7534e15ba6d9ef3d746873
SSDEEP 1536:FuUOVTwA4M29KTkDy3bCXSQrk6UCjTTdRtKrqi35RwGPJ:FuUyTwA4M29skDy3bCU6xTT4PwcJ
TLSH
T1ADB39F30EFD7B13AED6D4AFC5CA371314926A5D3150EF579FCC0329B4622AC1A5322A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

hyperinocasino.top:80
hyperinocasino.top:443
www.hyperinocasino.top:80
www.hyperinocasino.top:443

Mutex

wyfnDDYXIguZ

Attributes

delay
3
install
true
install_file
RATMalware.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d00000001c5a1-10.dat	family_asyncrat

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5676	cmd.exe
3856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58b3a8f4827e858003f74cb3528a08b4bce190e362a7177a2727e1a9ec3e7b87.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5972	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1444	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\58b3a8f4827e858003f74cb3528a08b4bce190e362a7177a2727e1a9ec3e7b87.exe
"C:\Users\Admin\AppData\Local\Temp\58b3a8f4827e858003f74cb3528a08b4bce190e362a7177a2727e1a9ec3e7b87.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RATMalware" /tr '"C:\Users\Admin\AppData\Roaming\RATMalware.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:3856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "RATMalware" /tr '"C:\Users\Admin\AppData\Roaming\RATMalware.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7805.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:5676
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:5972
- - C:\Users\Admin\AppData\Roaming\RATMalware.exe
    "C:\Users\Admin\AppData\Roaming\RATMalware.exe"
    3⤵
    PID:1368

C:\Users\Admin\AppData\Roaming\RATMalware.exe
"C:\Users\Admin\AppData\Roaming\RATMalware.exe"
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp7805.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7805.tmp.bat
Size 154B
SHA256 c4dd84d9a27d5182fc2be444a5229df0ae0cebc2301dfc3a03bc0419e8a0ed59
MD5 3a194a939a35f9590ea0db4fb6a307c7
SHA1 7ad899c2402184fe65c6cbfc92f2e1572fcfefdc
SHA512 735a14d5f0c6f001f786044c6b91a5ecc8174d3aa4cf02dd76dffd392f692d181cf7bfb56e25432aa577b2e9fca56b28eaad41f8bcf06a9e1456e44e24439a91
TLSH
T1EAC08C4265C5AA0E2906642302BAD58CD1B268A93E44AB148704804D2280489E599246
MD5 SHA1 SHA512 TLSH

Submit Download

RATMalware.exe

Path C:\Users\Admin\AppData\Roaming\RATMalware.exe
Size 111KB
SHA256 58b3a8f4827e858003f74cb3528a08b4bce190e362a7177a2727e1a9ec3e7b87
MD5 3a18f06ffc1a04e66db8cecafab915de
SHA1 425492012921b3d16c8b72604ab6a344aed03291
SHA512 434c6afeeb182ee3c64bf4b373a81d3d928991cadaa4bad098e01baf403e30c121a512380a540637275116123e67247b1db9ff501c7534e15ba6d9ef3d746873
SSDEEP 1536:FuUOVTwA4M29KTkDy3bCXSQrk6UCjTTdRtKrqi35RwGPJ:FuUyTwA4M29skDy3bCU6xTT4PwcJ
TLSH
T1ADB39F30EFD7B13AED6D4AFC5CA371314926A5D3150EF579FCC0329B4622AC1A5322A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-12-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/1164-14-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/4128-0-0x0000000074242000-0x0000000074243000-memory.dmp

Download

memory/4128-1-0x0000000000D70000-0x0000000000D92000-memory.dmp

Download

memory/4128-2-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

memory/4128-3-0x0000000005910000-0x00000000059AC000-memory.dmp

Download

memory/4128-9-0x0000000074230000-0x00000000749EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads