asyncrat | d5f1dbca6abe897ff8473b7a9fab9a17147c8af8d751594ce6a74c9bc2cc98c4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
13/11/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
junobigboy.exe
Size 45KB
Sample261113-red8gacw4l
SHA256 d5f1dbca6abe897ff8473b7a9fab9a17147c8af8d751594ce6a74c9bc2cc98c4
MD5 9228a0a7a4622c40eef25c4a985bdb07
SHA1 bd763efdd4c7f373228c8c619c5798085bbeddec
SHA512 08ba5d19eb0e9305491e2f9bbcf17a0e6c54ce8dc8a4f24403ab23f8c0eaac780143e12cacceed4b0e227125cd6e5d72bd7a6990c1b0addd7fa91af1367ed60c
SSDEEP 768:muQPPTUo04QiWUUmjSmo2qMC77DfI1PIdzjbCgX3i1AZA1XTNnPPYfBDZyx:muQPPTUwa2G73wSd3blXS1A+1XTN4pdw
TLSH
T128232A003BE8812BF2BE4BB89CF35145867AF1673603D94A2CC452DB5613FC69A436F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default discovery asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ko66.asia:443
ko66.asia:80
www.ko66.asia:443
www.ko66.asia:80

Mutex

I5NtyVhYPllG

Attributes

delay
5
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	junobigboy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	junobigboy.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	junobigboy.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	junobigboy.exe
Token: SeDebugPrivilege	3232	junobigboy.exe

C:\Users\Admin\AppData\Local\Temp\junobigboy.exe
"C:\Users\Admin\AppData\Local\Temp\junobigboy.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3232-0-0x0000000000900000-0x0000000000912000-memory.dmp

Download

memory/3232-1-0x0000000005370000-0x0000000005380000-memory.dmp