asyncrat | 544f76883e072a411c381515e3894abad6175a2d629863276b6542d6ff4d588e

Analysis

max time kernel
58s
max time network
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
544f76883e072a411c381515e3894abad6175a2d629863276b6542d6ff4d588e.exe
Size 67KB
Sample261029-x5rt5set7x
SHA256 544f76883e072a411c381515e3894abad6175a2d629863276b6542d6ff4d588e
MD5 6818601e699f9288b0d1ed41ae13d206
SHA1 62b9fdef35dd13f12f020b9bbf591ea44c65b188
SHA512 c4e860ddd179f79aec21765cbc606b1bf4b1bf7f46de86488133d65075ec8e919175e297e3d24b96590b837be9f22d83ed991a46ae0195479ea644840056f8eb
SSDEEP 1536:EOu3xT58ocIstxITr7bCWcexe0PKJGRGIgVclN:EOu5jcIsE7bk0CARGIaY
TLSH
T1F5636D013B988D37E1BE9AB96DF2510142B4D5A32152DB4F3CC850DE9B23FC599136EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

rr88.gratis:443
rr88.gratis:8080
www.rr88.gratis:443
www.rr88.gratis:8080
c2.rr88.gratis:443
c2.rr88.gratis:8080
backdoor.rr88.gratis:443
backdoor.rr88.gratis:8080
rr88.channel:443
rr88.channel:8080
www.rr88.channel:443
www.rr88.channel:8080
c2.rr88.channel:443
c2.rr88.channel:8080
backdoor.rr88.channel:443
backdoor.rr88.channel:8080
rr888.co:443
rr888.co:8080
www.rr888.co:443
www.rr888.co:8080
c2.rr888.co:443
c2.rr888.co:8080
backdoor.rr888.co:443
backdoor.rr888.co:8080
rr88tv.com:443
rr88tv.com:8080
www.rr88tv.com:443
www.rr88tv.com:8080
c2.rr88tv.com:443
c2.rr88tv.com:8080
backdoor.rr88tv.com:443
backdoor.rr88tv.com:8080
rr88.health:443
rr88.health:8080
www.rr88.health:443
www.rr88.health:8080
c2.rr88.health:443
c2.rr88.health:8080
backdoor.rr88.health:443
backdoor.rr88.health:8080

Mutex

tHzY44jDoDOKGYrz

Attributes

delay
0
install
false
install_file
Client.exe
install_folder
AppData

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1724	5840	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	544f76883e072a411c381515e3894abad6175a2d629863276b6542d6ff4d588e.exe

C:\Users\Admin\AppData\Local\Temp\544f76883e072a411c381515e3894abad6175a2d629863276b6542d6ff4d588e.exe
"C:\Users\Admin\AppData\Local\Temp\544f76883e072a411c381515e3894abad6175a2d629863276b6542d6ff4d588e.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5840 -s 852
  2⤵
  - Program crash
  PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5840 -ip 5840
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5840-0-0x00000000749F2000-0x00000000749F3000-memory.dmp

Download

memory/5840-1-0x00000000008D0000-0x00000000008E6000-memory.dmp