File name:

AutoIT.rar

Full analysis: https://app.any.run/tasks/92478da8-26d9-4cf8-9052-78e41933ed7d
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: December 30, 2023, 11:34:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
rat
asyncrat
remote
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

FE3707649DB7A2F3A04996DA9D45C480

SHA1:

34AA27F583A68F52B6491469500FDDB171157759

SHA256:

211585E7E47E623E835C4A3F4DE86C46817135BEE07856B0F7BEEE4226B308BE

SSDEEP:

24576:v82HcArwiJAFg0wkHTGiXIg9ZrXpCbObcZvoPfypHiUx5ffCN1DJ5Qr:v82HcArw+AFg0w0TGiXIyZjpCbObcZvT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • cmd.exe (PID: 1652)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1588)

    • ASYNCRAT has been detected (YARA)

      • jsc.exe (PID: 1820)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • wscript.exe (PID: 2444)

    • Reads the Internet Settings

      • wscript.exe (PID: 2444)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2444)

  • INFO

    • Drops the AutoIt3 executable file

      • WinRAR.exe (PID: 2120)
      • Moscow.pif (PID: 1044)

    • Reads mouse settings

      • Moscow.pif (PID: 1044)
      • MarketWise.pif (PID: 1924)

    • Checks supported languages

      • Moscow.pif (PID: 1044)
      • jsc.exe (PID: 1820)
      • MarketWise.pif (PID: 1924)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2120)
      • Moscow.pif (PID: 1044)

    • Manual execution by a user

      • Moscow.pif (PID: 1044)
      • cmd.exe (PID: 1652)
      • cmd.exe (PID: 1588)
      • jsc.exe (PID: 1820)

    • Creates files or folders in the user directory

      • Moscow.pif (PID: 1044)

    • Process drops legitimate windows executable

      • Moscow.pif (PID: 1044)

    • Reads the computer name

      • Moscow.pif (PID: 1044)
      • jsc.exe (PID: 1820)

    • Reads the machine GUID from the registry

      • jsc.exe (PID: 1820)

    • Reads Environment values

      • jsc.exe (PID: 1820)

    • ASYNCRAT has been detected (SURICATA)

      • jsc.exe (PID: 1820)

    • Connects to unusual port

      • jsc.exe (PID: 1820)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(1820) jsc.exe
C2 (1)love1.loseyourip.com
Ports (1)2004
BotnetDefault
Version| Edit by Vinom Rat
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAIu8YgLOOykBZes0C87FDTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjMxMDIwMTk0MTA2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKWlVzOxwMVEpaMaG8aMhHnYLKFx9LQ/W6aVV1ma0KSSEBfJ7SBrW3z1/rZ+oO2EqQDV9uYdfSc3...
Server_SignatureUWpxQvOAuBSNYkwB8f9zBOoE5HKwFS3rZuMrPLHZ7ZIFMDnQRueOsaHOLDPw6BpudI8bf2ceOCUgNQudRg6Ru01b7/iyYmnCKNFuOvgrcbuk4w8pVsR0NQ0Uuvo/tL8kfX++z7/OslybSzNruvjdnsTSA3k2kuNqHzVHnrljpmmkS90n3Rt16GKxnuYOSIxCuJmNzO0IgvB3xsnV37OMPtFMzwQ/LHnAc5JvPPE1VlaFGJpbXTXfcNtIP4PT86JJJPkSfI/xwIoTL5JK4P8d3SYo10MUqNJ+LrRgWFR3EwN2...
Keys
AES9b3555e46cd176ac127c4424fb7586602fd0b0eb208c17546118f13828cb0d9a
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
8
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs moscow.pif no specs cmd.exe cmd.exe no specs schtasks.exe no specs #ASYNCRAT jsc.exe wscript.exe no specs marketwise.pif no specs

Process information

PID
CMD
Path
Indicators
Parent process
1044"C:\Users\admin\Desktop\AutoIT\Moscow.pif" C:\Users\admin\Desktop\AutoIT\xC:\Users\admin\Desktop\AutoIT\Moscow.pif—explorer.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 4
Modules
Images
c:\users\admin\desktop\autoit\moscow.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1216schtasks.exe /create /tn "Watson" /tr "wscript 'C:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.js'" /sc minute /mo 3 /FC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1588cmd /c schtasks.exe /create /tn "Watson" /tr "wscript 'C:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.js'" /sc minute /mo 3 /FC:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1652cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MarketWise.url" & echo URL="C:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MarketWise.url" & exitC:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1820C:\Users\admin\Desktop\AutoIT\jsc.exe C:\Users\admin\Desktop\AutoIT\jsc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
jsc.exe
Exit code:
0
Version:
14.8.3761.0 built by: NET48REL1
Modules
Images
c:\users\admin\desktop\autoit\jsc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
AsyncRat
(PID) Process(1820) jsc.exe
C2 (1)love1.loseyourip.com
Ports (1)2004
BotnetDefault
Version| Edit by Vinom Rat
Options
AutoRunfalse
MutexAsyncMutex_6SI8OkPnk
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAIu8YgLOOykBZes0C87FDTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjMxMDIwMTk0MTA2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKWlVzOxwMVEpaMaG8aMhHnYLKFx9LQ/W6aVV1ma0KSSEBfJ7SBrW3z1/rZ+oO2EqQDV9uYdfSc3...
Server_SignatureUWpxQvOAuBSNYkwB8f9zBOoE5HKwFS3rZuMrPLHZ7ZIFMDnQRueOsaHOLDPw6BpudI8bf2ceOCUgNQudRg6Ru01b7/iyYmnCKNFuOvgrcbuk4w8pVsR0NQ0Uuvo/tL8kfX++z7/OslybSzNruvjdnsTSA3k2kuNqHzVHnrljpmmkS90n3Rt16GKxnuYOSIxCuJmNzO0IgvB3xsnV37OMPtFMzwQ/LHnAc5JvPPE1VlaFGJpbXTXfcNtIP4PT86JJJPkSfI/xwIoTL5JK4P8d3SYo10MUqNJ+LrRgWFR3EwN2...
Keys
AES9b3555e46cd176ac127c4424fb7586602fd0b0eb208c17546118f13828cb0d9a
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
1924"C:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.pif" "C:\Users\admin\AppData\Local\Insightful Markets Technologies\A"C:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.pif—wscript.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 4
Modules
Images
c:\users\admin\appdata\local\insightful markets technologies\marketwise.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\AutoIT.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2444C:\Windows\system32\wscript.EXE "C:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.js"C:\Windows\System32\wscript.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 145
Read events
2 103
Write events
42
Delete events
0

Modification events

(PID) Process:(2120) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2120) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
3
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1652cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MarketWise.urltext
MD5:353795816AE5B37D44A9024159D27EA8
SHA256:C0FC703B325B80CD526B0CF1AAA1A1BFEBBBFCB68A00B2493F690B950722E242
1044Moscow.pifC:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.pifexecutable
MD5:848164D084384C49937F99D5B894253E
SHA256:F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2120.7988\AutoIT\Moscow.pifexecutable
MD5:848164D084384C49937F99D5B894253E
SHA256:F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3
1044Moscow.pifC:\Users\admin\AppData\Local\Insightful Markets Technologies\MarketWise.jstext
MD5:4583EE0039924880F289FC204D52368B
SHA256:20FC2895E04BB3029ED2B68C3B35A5B1B538A5218D0DDD4C76542BDFF5425D4D
1044Moscow.pifC:\Users\admin\AppData\Local\Insightful Markets Technologies\Atext
MD5:97EC1836EDE6602974D17B6901CAFBB1
SHA256:14BEBC518958785C7A40234081970DD19B2526E30E7A1266FD9E2D52CEBBCCFD
2120WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2120.7988\AutoIT\xtext
MD5:97EC1836EDE6602974D17B6901CAFBB1
SHA256:14BEBC518958785C7A40234081970DD19B2526E30E7A1266FD9E2D52CEBBCCFD
1044Moscow.pifC:\Users\admin\Desktop\AutoIT\jsc.exeexecutable
MD5:AC1D6E39956F1924DAC0B0FF6A83C5FE
SHA256:7410599261912DDD9F7136BF1142BD14358BEEFA4126CDE47E18FC9F6606A569
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
3

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1820
jsc.exe
193.26.115.142:2004
love1.loseyourip.com
RELIABLESITE
US
malicious

DNS requests

Domain
IP
Reputation
KUHhhnlUmHdzjZFqZYoOtpryMyR.KUHhhnlUmHdzjZFqZYoOtpryMyR
  • —
unknown
love1.loseyourip.com
  • 193.26.115.142
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.loseyourip .com Domain
1820
jsc.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AutoIT.rar