File name:

RC7 Cracked Edition.exe

Full analysis: https://app.any.run/tasks/6e008610-aa55-4eb6-a3da-670fde066fc8
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: February 01, 2025, 12:00:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

1E58EB4E24BFBF4C7214002D00C74FCC

SHA1:

AC476E9B820D15070B40BC8009CBC12DC9788B6D

SHA256:

1CE020A04A6D3FB5562A6CCE5878ED49FC2C69BC98F4331136D30E585115C209

SSDEEP:

1536:DSSXOhmQz2hmbUSkhlYUbohe8Y0g5OhpqKmY7:DSSXObz2hmbbkhlYUboNffaz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (YARA)

      • RC7 Cracked Edition.exe (PID: 4132)

  • SUSPICIOUS

    • Connects to unusual port

      • RC7 Cracked Edition.exe (PID: 4132)

  • INFO

    • Checks supported languages

      • RC7 Cracked Edition.exe (PID: 4132)

    • Manual execution by a user

      • Taskmgr.exe (PID: 7024)
      • Taskmgr.exe (PID: 6368)
      • Taskmgr.exe (PID: 6196)
      • Taskmgr.exe (PID: 7072)

    • Reads Environment values

      • RC7 Cracked Edition.exe (PID: 4132)

    • Reads the computer name

      • RC7 Cracked Edition.exe (PID: 4132)

    • Reads the machine GUID from the registry

      • RC7 Cracked Edition.exe (PID: 4132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(4132) RC7 Cracked Edition.exe
C2 (2)127.0.0.1
break-aaron.gl.at.ply.gg
Ports (1)31133
Version
Options
AutoRunfalse
Mutex伊比x991ץΓsNeW诶بIey吉يPץ吉3X
InstallFolder%AppData%
Certificates
Cert1MIICKTCCAZKgAwIBAgIVAIlPfoGhSVRtZh9Aefv6Bsx9o4EJMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwNDIyMTEyNjE5WhcNMzUwMTMwMTEyNjE5WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA...
Server_SignatureKv4UMzbBlts7nd+t8FtrCJ+QaFUT50LNl7JDXsTpsLAATZYhdVpMplW9GZSCVCu7prwFW75TSNJ4CiL8FFT3rx6yfYwdoqJlRsVGvfG5mY/uxq655Qy9Z4wvpicKjsoEXVNmC0xnvZJqoRmh94xUptWqvbkNJqYU7m9jxXr1AV8=
Keys
AESde0787118c81151bde99d36a67be2c7cbe9a352ec184fd32ca4dcd3757b033bc
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:24 17:30:14+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 60416
InitializedDataSize: 4096
UninitializedDataSize: -
EntryPoint: 0x10a2e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Roblox Exploit 17.6
FileVersion: 0.0.0.0
InternalName: RC7 Cracked
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: RC7 Cracked
ProductName: RC7 Cracked Edition
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ASYNCRAT rc7 cracked edition.exe taskmgr.exe no specs taskmgr.exe taskmgr.exe no specs svchost.exe taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4132"C:\Users\admin\AppData\Local\Temp\RC7 Cracked Edition.exe" C:\Users\admin\AppData\Local\Temp\RC7 Cracked Edition.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Roblox Exploit 17.6
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rc7 cracked edition.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(4132) RC7 Cracked Edition.exe
C2 (2)127.0.0.1
break-aaron.gl.at.ply.gg
Ports (1)31133
Version
Options
AutoRunfalse
Mutex伊比x991ץΓsNeW诶بIey吉يPץ吉3X
InstallFolder%AppData%
Certificates
Cert1MIICKTCCAZKgAwIBAgIVAIlPfoGhSVRtZh9Aefv6Bsx9o4EJMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwNDIyMTEyNjE5WhcNMzUwMTMwMTEyNjE5WjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA...
Server_SignatureKv4UMzbBlts7nd+t8FtrCJ+QaFUT50LNl7JDXsTpsLAATZYhdVpMplW9GZSCVCu7prwFW75TSNJ4CiL8FFT3rx6yfYwdoqJlRsVGvfG5mY/uxq655Qy9Z4wvpicKjsoEXVNmC0xnvZJqoRmh94xUptWqvbkNJqYU7m9jxXr1AV8=
Keys
AESde0787118c81151bde99d36a67be2c7cbe9a352ec184fd32ca4dcd3757b033bc
SaltDcRatByqwqdanchun
6196"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
6368"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\powrprof.dll
7024"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
7072"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
533
Read events
532
Write events
0
Delete events
1

Modification events

(PID) Process:(6368) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:delete valueName:Preferences
Value:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
27
DNS requests
14
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7124
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6512
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7124
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5916
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.16.204.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
184.30.18.9:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
4132
RC7 Cracked Edition.exe
147.185.221.22:31133
break-aaron.gl.at.ply.gg
PLAYIT-GG
US
malicious
4704
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.16.204.155
  • 2.16.204.143
  • 2.16.204.152
  • 2.16.204.156
  • 2.16.204.134
  • 2.16.204.135
  • 2.16.204.142
  • 2.16.204.160
  • 2.16.204.141
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.4
  • 20.190.160.64
  • 20.190.160.2
  • 40.126.32.138
  • 20.190.160.5
whitelisted
go.microsoft.com
  • 184.30.18.9
whitelisted
break-aaron.gl.at.ply.gg
  • 147.185.221.22
malicious
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
—
—
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RC7 Cracked Edition.exe