asyncrat | 8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc

Analysis

max time kernel
59s
max time network
61s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc.exe
Size 45KB
Sample261029-xyg2cset4z
SHA256 8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc
MD5 1c03c18c823e91ed1dfc8fd973d8802a
SHA1 69153f6dc52cf6b35b662b7c8fb2c696c979fc07
SHA512 8b7f1626d1c35731c1823014a8c9d05a9b83d4d989e07e6e67293a0a864a2d5ce3255e5f32faf6ab08cb24cb5c817feb1e53abcf32f41f039e5365977239a750
SSDEEP 768:ZuYART4Ir9LWU3NxCmo2qZYGXDahWKsjbdgX3imEJUBfrpcDZsf+:ZuYART4UA2J2+gKcbKXSmEJUBGdsf+
TLSH
T1582319003BE9812BF2BE4F7899F2614545BAF2633603D65D1CC8419B5613FC6CA52AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

rr88.gratis:443
rr88.gratis:8080
www.rr88.gratis:443
www.rr88.gratis:8080
c2.rr88.gratis:443
c2.rr88.gratis:8080
backdoor.rr88.gratis:443
backdoor.rr88.gratis:8080
rr88.channel:443
rr88.channel:8080
www.rr88.channel:443
www.rr88.channel:8080
c2.rr88.channel:443
c2.rr88.channel:8080
backdoor.rr88.channel:443
backdoor.rr88.channel:8080
rr888.co:443
rr888.co:8080
www.rr888.co:443
www.rr888.co:8080
c2.rr888.co:443
c2.rr888.co:8080
backdoor.rr888.co:443
backdoor.rr888.co:8080
rr88tv.com:443
rr88tv.com:8080
www.rr88tv.com:443
www.rr88tv.com:8080
c2.rr88tv.com:443
c2.rr88tv.com:8080
backdoor.rr88tv.com:443
backdoor.rr88tv.com:8080
rr88.health:443
rr88.health:8080
www.rr88.health:443
www.rr88.health:8080
c2.rr88.health:443
c2.rr88.health:8080
backdoor.rr88.health:443
backdoor.rr88.health:8080

Mutex

zRDBhZoBiLW3

Attributes

delay
0
install
false
install_folder
AppData

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6036	8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc.exe

C:\Users\Admin\AppData\Local\Temp\8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc.exe
"C:\Users\Admin\AppData\Local\Temp\8bbfd9ff433b87b7e8586034634f986c249e6a2d176d34d2b528ad9f3006fdfc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6036-0-0x0000000075132000-0x0000000075133000-memory.dmp

Download

memory/6036-1-0x0000000000710000-0x0000000000722000-memory.dmp

Download

memory/6036-2-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

memory/6036-3-0x0000000075132000-0x0000000075133000-memory.dmp

Download

memory/6036-4-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads