File name:

1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a

Full analysis: https://app.any.run/tasks/5734b400-ce46-40e6-950d-7d8ce03001e9
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 01:57:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
pyinstaller
python
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

7A88F024575EFDB8A034FEDEA19C9C11

SHA1:

7BDC95B0A4016DDF5EA19E557429CB0DB16514D7

SHA256:

1C168219F487ED2749EAC61D8564BA214670A535FC4277B10773F4D4D8299E8A

SSDEEP:

98304:BkVH6KaNz9hl4T9TB6XzDL7ChuABolDPGTy9T1cMRo+o8D7VFtrQ/3L//OLBUOJS:Z/yBrSq90jSi6r986CFtpnx56f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • efgk.exe (PID: 7992)

    • ASYNCRAT has been detected (YARA)

      • Antimalware Core Servicex.exe (PID: 8188)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe (PID: 7876)

    • Executable content was dropped or overwritten

      • 1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe (PID: 7876)
      • 短信轰炸器.exe (PID: 7972)
      • efgk.exe (PID: 7992)

    • Reads the date of Windows installation

      • 1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe (PID: 7876)

    • Process drops legitimate windows executable

      • 短信轰炸器.exe (PID: 7972)

    • The process drops C-runtime libraries

      • 短信轰炸器.exe (PID: 7972)

    • Process drops python dynamic module

      • 短信轰炸器.exe (PID: 7972)

    • Executing commands from a ".bat" file

      • efgk.exe (PID: 7992)

    • Starts CMD.EXE for commands execution

      • efgk.exe (PID: 7992)

    • The executable file from the user directory is run by the CMD process

      • Antimalware Core Servicex.exe (PID: 8188)

    • Connects to unusual port

      • Antimalware Core Servicex.exe (PID: 8188)

    • Executes application which crashes

      • Antimalware Core Servicex.exe (PID: 7504)

    • There is functionality for taking screenshot (YARA)

      • 短信轰炸器.exe (PID: 7972)
      • 短信轰炸器.exe (PID: 516)

    • Application launched itself

      • 短信轰炸器.exe (PID: 7972)

    • Loads Python modules

      • 短信轰炸器.exe (PID: 516)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 8084)

  • INFO

    • Process checks computer location settings

      • 1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe (PID: 7876)

    • Reads the computer name

      • 1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe (PID: 7876)
      • 短信轰炸器.exe (PID: 7972)
      • efgk.exe (PID: 7992)
      • Antimalware Core Servicex.exe (PID: 8188)
      • 短信轰炸器.exe (PID: 516)

    • Checks supported languages

      • 短信轰炸器.exe (PID: 7972)
      • 1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe (PID: 7876)
      • efgk.exe (PID: 7992)
      • Antimalware Core Servicex.exe (PID: 8188)
      • Antimalware Core Servicex.exe (PID: 7504)
      • 短信轰炸器.exe (PID: 516)

    • The sample compiled with english language support

      • 短信轰炸器.exe (PID: 7972)

    • Reads the machine GUID from the registry

      • efgk.exe (PID: 7992)
      • Antimalware Core Servicex.exe (PID: 8188)

    • Create files in a temporary directory

      • 短信轰炸器.exe (PID: 7972)
      • efgk.exe (PID: 7992)

    • Creates files or folders in the user directory

      • efgk.exe (PID: 7992)
      • WerFault.exe (PID: 7400)

    • Auto-launch of the file from Registry key

      • efgk.exe (PID: 7992)

    • Manual execution by a user

      • Antimalware Core Servicex.exe (PID: 7504)

    • PyInstaller has been detected (YARA)

      • 短信轰炸器.exe (PID: 7972)
      • 短信轰炸器.exe (PID: 516)

    • Checks proxy server information

      • slui.exe (PID: 6004)

    • Reads the software policy settings

      • slui.exe (PID: 6004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(8188) Antimalware Core Servicex.exe
C2 (1)110.42.61.91
Ports (1)8995
VersionPortHack 1.0.0
Options
AutoRuntrue
MutexDcRatMutex
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAKTEcVbts/PEwS7j1NQs9gm8MTvZMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDcyOTExNDMwOFoXDTM1MDUwODExNDMwOFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureT4oul2WeKlORf3LiX9BKRbUDrG/U4WIJAh0HEArcfBHmTBB9qWL0JogPvxZdQp62EzwKKtboKNnwUbBCdcl0wuUlWwRvIUomcerpYvPgUox4LHgFCnT8mlOb/je+VZzWjvPbgwgprdHO5hW0nuMawXVKkCuhdxMRc+thYJuc3YE=
Keys
AESc2b1bd9ba2d16de08a82eb6f34936f4de4e3c1b3c47d093691afda994ac5f597
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:02:26 09:01:47+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 288768
InitializedDataSize: 171520
UninitializedDataSize: -
EntryPoint: 0x32e60
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
14
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe 短信轰炸器.exe efgk.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT antimalware core servicex.exe conhost.exe no specs antimalware core servicex.exe conhost.exe no specs werfault.exe no specs 短信轰炸器.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Windows\Temp\短信轰炸器.exe" C:\Windows\Temp\短信轰炸器.exe—短信轰炸器.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\temp\短信轰炸器.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5588\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Antimalware Core Servicex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6004C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Antimalware Core Servicex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7400C:\WINDOWS\system32\WerFault.exe -u -p 7504 -s 216C:\Windows\System32\WerFault.exe—Antimalware Core Servicex.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
7504"C:\Users\admin\AppData\Roaming\Antimalware Core Servicex.exe"C:\Users\admin\AppData\Roaming\Antimalware Core Servicex.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\roaming\antimalware core servicex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7876"C:\Users\admin\Desktop\1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe" C:\Users\admin\Desktop\1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7972"C:\Windows\Temp\短信轰炸器.exe" C:\Windows\Temp\短信轰炸器.exe
1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\temp\短信轰炸器.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7992"C:\Windows\Temp\efgk.exe" C:\Windows\Temp\efgk.exe
1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\temp\efgk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
8000\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—efgk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 343
Read events
6 342
Write events
1
Delete events
0

Modification events

(PID) Process:(7992) efgk.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Antimalware Core Servicex
Value:
"C:\Users\admin\AppData\Roaming\Antimalware Core Servicex.exe"
Executable files
30
Suspicious files
7
Text files
941
Unknown types
0

Dropped files

PID
Process
Filename
Type
78761c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exeC:\Windows\Temp\baili.pngbinary
MD5:27512435DA794092E0A3DD363B721AEA
SHA256:D7F222C345A950FD8CA41814694479041C87CC00E86B1CCFE80146691B755013
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\_asyncio.pydexecutable
MD5:56F958EEBBC62305B4BF690D61C78E28
SHA256:50631361EF074BE42D788818AF91D0301D22FA24A970F41F496D8272B92CFE31
78761c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a.exeC:\Windows\Temp\短信轰炸器.exeexecutable
MD5:F68AA26FF1817FD095429E380A8D755C
SHA256:BDED591497224DDF09D9137D5AC41521654ADA8426D75BF0E7C71165C20D4DF1
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\_hashlib.pydexecutable
MD5:3E540EF568215561590DF215801B0F59
SHA256:0ED7A6ED080499BC6C29D7113485A8A61BDBA93087B010FCA67D9B8289CBE6FA
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\VCRUNTIME140.dllexecutable
MD5:32DA96115C9D783A0769312C0482A62D
SHA256:8B10C53241726B0ACC9F513157E67FCB01C166FEC69E5E38CA6AADA8F9A3619F
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\VCRUNTIME140_1.dllexecutable
MD5:C0C0B4C611561F94798B62EB43097722
SHA256:497A280550443E3E9F89E428E51CB795139CA8944D5DEDD54A7083C00E7164E5
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\_bz2.pydexecutable
MD5:684D656AADA9F7D74F5A5BDCF16D0EDB
SHA256:A5DFB4A663DEF3D2276B88866F6D220F6D30CC777B5D841CF6DBB15C6858017C
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\_ctypes.pydexecutable
MD5:29873384E13B0A78EE9857604161514B
SHA256:3CC8500A958CC125809B0467930EBCCE88A09DCC0CEDD7A45FACF3E332F7DB33
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\_lzma.pydexecutable
MD5:D63E2E743EA103626D33B3C1D882F419
SHA256:7C2D2030D5D246739C5D85F087FCF404BC36E1815E69A8AC7C9541267734FC28
7972短信轰炸器.exeC:\Users\admin\AppData\Local\Temp\_MEI79722\_multiprocessing.pydexecutable
MD5:807DD90BE59EA971DAC06F3AAB4F2A7E
SHA256:B20DD6F5FAB31476D3D8D7F40CB5AB098117FA5612168C0FF4044945B6156D47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
39
DNS requests
21
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
8188
Antimalware Core Servicex.exe
110.42.61.91:8995
—
NINGBO, ZHEJIANG Province, P.R.China.
CN
malicious
7244
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7244
SIHClient.exe
40.69.42.241:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7760
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6004
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.130
  • 40.126.32.136
  • 20.190.160.2
  • 20.190.160.131
  • 40.126.32.134
  • 40.126.32.72
  • 20.190.160.132
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1c168219f487ed2749eac61d8564ba214670a535fc4277b10773f4d4d8299e8a