| File name: | 4363463463464363463463463.exe |
| Full analysis: | https://app.any.run/tasks/e8051a8b-791c-48d7-b38b-bd0a2d0f86f8 |
| Verdict: | Malicious activity |
| Threats: | AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions. |
| Analysis date: | May 17, 2025, 17:59:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 2A94F3960C58C6E70826495F76D00B85 |
| SHA1: | E2A1A5641295F5EBF01A37AC1C170AC0814BB71A |
| SHA256: | 2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE |
| SSDEEP: | 192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY |
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:12:22 08:29:10+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32 |
| LinkerVersion: | 80 |
| CodeSize: | 5632 |
| InitializedDataSize: | 4608 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x3552 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | |
| FileVersion: | 0.0.0.0 |
| InternalName: | 4363463463464363463463463.exe |
| LegalCopyright: | |
| OriginalFileName: | 4363463463464363463463463.exe |
| ProductVersion: | 0.0.0.0 |
| AssemblyVersion: | 0.0.0.0 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Users\admin\Desktop\Files\RedLineStealer.exe" | C:\Users\admin\Desktop\Files\RedLineStealer.exe | 4363463463464363463463463.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 328 | "C:\Users\admin\Desktop\4363463463464363463463463.exe" | C:\Users\admin\Desktop\4363463463464363463463463.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Version: 0.0.0.0 Modules
| |||||||||||||||
| 392 | "C:\Users\admin\Desktop\4363463463464363463463463.exe" | C:\Users\admin\Desktop\4363463463464363463463463.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Version: 0.0.0.0 Modules
| |||||||||||||||
| 448 | "C:\Users\admin\Desktop\4363463463464363463463463.exe" | C:\Users\admin\Desktop\4363463463464363463463463.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 3221226540 Version: 0.0.0.0 Modules
| |||||||||||||||
| 576 | "C:\Users\admin\Desktop\Files\QuizPokemon.exe" | C:\Users\admin\Desktop\Files\QuizPokemon.exe | — | 4363463463464363463463463.exe | |||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 604 | "C:\Users\admin\Desktop\4363463463464363463463463.exe" | C:\Users\admin\Desktop\4363463463464363463463463.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Version: 0.0.0.0 Modules
| |||||||||||||||
| 676 | "schtasks" /create /tn "kazeku" /sc ONLOGON /tr "C:\Program Files\kazeku\Client.exe" /rl HIGHEST /f | C:\Windows\System32\schtasks.exe | — | Client.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 704 | "C:\Users\admin\AppData\Roaming\SubDir\SYSTEM26.exe" | C:\Users\admin\AppData\Roaming\SubDir\SYSTEM26.exe | Client-built.exe | ||||||||||||
User: admin Company: Armadillo Integrity Level: HIGH Description: Armadillo Version: 1.1.1.1 Modules
Quasar(PID) Process(704) SYSTEM26.exe Version1.4.1 C2 (2)193.161.193.99:43242 Sub_DirSubDir Install_NameSYSTEM26.exe Mutex45bfb701-bea2-411a-948d-9a6abe001f83 StartupQuasar Client Startup TagOffice04 LogDirLogs SignaturefgGaLVju6grfZnD4PPuru2jUduIFJygb5i6fCpU3bziLhuLT5af3XSRbhwZLLa6TE2gcGWOGYZsTfu2JQENil9JWYLxuaslxPjsfablnw40FlQTR2cATsntd0SDjvqNXPbN/qeLvnSBdfnIQ/nvSx2eSxrveB3/AM/IHQP3jKnDTQgrCMkquVLbL8TUF7UYmJ+fgDelDbnFmURMFJLKyKppfDXNdaooIkpPMmQelRpf+FvrKGvyXs0g8MsnrPV2CDVQl2Hi3qDu95MWrq6LM4LxULL3M1MJKzYXRB1DWDs90... CertificateMIIE9DCCAtygAwIBAgIQAL0ekW4W+GtVWO3mhdexIzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMTEwMjEwMTUyNVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAwB8TLl8NiSNYTIL30uRXiovzaQVRY49Q4J5LKHvSxVvE97GAtyLoPCsixC+nvRPN3OOi8d1x... | |||||||||||||||
| 880 | "C:\Windows\system32\ntvdm.exe" -i7 | C:\Windows\System32\ntvdm.exe | — | 4363463463464363463463463.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: NTVDM.EXE Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 944 | "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\WIndows\svchost.exe"' & exit | C:\Windows\System32\cmd.exe | Client.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| (PID) Process: | (1080) svchost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet |
| Operation: | write | Name: | {4040CF00-1B3E-486A-B407-FA14C56B6FC0} |
Value: D4DA6D3E3157 | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1748) 4363463463464363463463463.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1748 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\TEST.exe | executable | |
MD5:3435DFBBE9E1FB098036AFCD7B7E0D32 | SHA256:6A3222ECABE6739E9016073DA83D46D2B8E2BD59B1AC200C3285FDE3287E3EA8 | |||
| 1748 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\856.exe | executable | |
MD5:68EDAFE0A1705D5C7DD1CB14FA1CA8CE | SHA256:68F0121F2062AEDE8AE8BD52BBA3C4C6C8AA19BDF32958B4E305CF716A92CC3D | |||
| 3168 | Client-built10.exe | C:\Program Files\kazeku\Client.exe | executable | |
MD5:8B09B710CF79DA2DBB54AC8548EEE0AD | SHA256:F47017465588D49383D9BB5071956E251D4C2AB024270F97B6BA35A3E6E7DEC8 | |||
| 1748 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\MS14-068.exe | executable | |
MD5:6450254D888950D0137DA706C58B2FE4 | SHA256:6782C5111ABD17435851432895B55CC6371D323A06D710801551CEA800BF65D0 | |||
| 1748 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\Client-built.exe | executable | |
MD5:BE5735282826036DCACC522C081365A0 | SHA256:78FE9F9CAC3E4D5CF653BE4475C8F247D4803379365DD44320716EA7384A8C11 | |||
| 1748 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\govno__dlya_jertwy.exe | executable | |
MD5:BF68EA3C0EDD59A4238C9789BA1B4996 | SHA256:32AC6C7FAEE6EE709F1AC4EAC2254C171C683A1911495101CAA91012F790A287 | |||
| 1748 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\mixseven.exe | executable | |
MD5:B3DBEC41EE7D66679D2A6DFD87BC8D8D | SHA256:5316D399E974A1D82FC6556C809617847A429AA0417531A82CBD8A1EC066973F | |||
| 1748 | 4363463463464363463463463.exe | C:\Users\admin\Desktop\Files\CPDB.exe | executable | |
MD5:DAF531BE28CA056A8E9A40966AB83CF0 | SHA256:8B96D4F6DDFCB00B4921F876FEA0420B9BAB29C3D572DA3E95335E978C2F94E5 | |||
| 3824 | MS14-068.exe | C:\Users\admin\AppData\Local\Temp\_MEI38242\Microsoft.VC90.CRT.manifest | xml | |
MD5:7DCB4E72D0CED888DF4A6C224F284DEE | SHA256:97DCBB29DFAF4076CFAB4D6503855CFB03102AC1932910DCEA0A22E61D0A6549 | |||
| 2988 | Client-built.exe | C:\Users\admin\AppData\Roaming\SubDir\SYSTEM26.exe | executable | |
MD5:BE5735282826036DCACC522C081365A0 | SHA256:78FE9F9CAC3E4D5CF653BE4475C8F247D4803379365DD44320716EA7384A8C11 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3420 | 4363463463464363463463463.exe | GET | 301 | 140.82.121.3:80 | http://github.com/ff245185/payload/raw/refs/heads/main/Fast%20Download.exe | unknown | — | — | whitelisted |
328 | 4363463463464363463463463.exe | GET | 200 | 75.127.7.164:80 | http://75.127.7.164/Supawn.exe | unknown | — | — | unknown |
3420 | 4363463463464363463463463.exe | GET | 301 | 140.82.121.3:80 | http://github.com/mariolalo/myrec/raw/refs/heads/main/NOTallowedtocrypt.exe | unknown | — | — | whitelisted |
1748 | 4363463463464363463463463.exe | GET | 200 | 185.158.94.217:80 | http://185.158.94.217/02.08.2022.exe | unknown | — | — | unknown |
328 | 4363463463464363463463463.exe | GET | 200 | 114.201.95.60:80 | http://www.medises.co.kr/AsMedises/PXray_Cast_Sort.exe | unknown | — | — | unknown |
3048 | 4363463463464363463463463.exe | GET | — | 158.101.35.62:9000 | http://158.101.35.62:9000/xblkpfZ8Y4.exe | unknown | — | — | unknown |
944 | 4363463463464363463463463.exe | GET | 200 | 51.195.19.98:80 | http://dddos.persiangig.com/.GgQ2Q4JUpA/other/jingling.exe | unknown | — | — | unknown |
3968 | 4363463463464363463463463.exe | GET | 200 | 87.121.84.254:80 | http://check-for-status.cc/1337/TORRENTOLD-1.exe | unknown | — | — | unknown |
328 | 4363463463464363463463463.exe | GET | 200 | 159.253.43.129:80 | http://turkey-ivf.org/Invoice4231284.exe | unknown | — | — | malicious |
3884 | 4363463463464363463463463.exe | GET | 200 | 154.29.78.35:80 | http://tirtasentosa.com/give/ukbros003.exe | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
1748 | 4363463463464363463463463.exe | 151.101.130.49:443 | urlhaus.abuse.ch | FASTLY | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1748 | 4363463463464363463463463.exe | 80.72.24.103:443 | test.aionclassic.pro | Mikhail Mayorov | RU | unknown |
1748 | 4363463463464363463463463.exe | 140.82.121.3:443 | github.com | GITHUB | US | whitelisted |
1748 | 4363463463464363463463463.exe | 185.199.108.133:443 | raw.githubusercontent.com | FASTLY | US | whitelisted |
1748 | 4363463463464363463463463.exe | 185.199.110.133:443 | raw.githubusercontent.com | FASTLY | US | whitelisted |
3376 | Client.exe | 18.141.106.224:10431 | 0.tcp.ap.ngrok.io | AMAZON-02 | SG | malicious |
704 | SYSTEM26.exe | 193.161.193.99:43242 | — | OOO Bitree Networks | RU | malicious |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
urlhaus.abuse.ch |
| whitelisted |
test.aionclassic.pro |
| unknown |
github.com |
| whitelisted |
raw.githubusercontent.com |
| whitelisted |
objects.githubusercontent.com |
| whitelisted |
0.tcp.ap.ngrok.io |
| malicious |
otrodia8912.gleeze.com |
| malicious |
download.pdf00.cn |
| malicious |
6.tcp.eu.ngrok.io |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |
1080 | svchost.exe | Misc activity | ET INFO DNS Query to a *.ngrok domain (ngrok.io) |
1080 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.gleeze .com Domain |
1748 | 4363463463464363463463463.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
1080 | svchost.exe | Misc activity | ET INFO DNS Query to a *.ngrok domain (ngrok.io) |
2944 | govno__dlya_jertwy.exe | Misc activity | ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format |
2944 | govno__dlya_jertwy.exe | Malware Command and Control Activity Detected | ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) |
2944 | govno__dlya_jertwy.exe | Malware Command and Control Activity Detected | BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll |
1080 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
1080 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
Process | Message |
|---|---|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | Unable to connect to the remote server
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|
4363463463464363463463463.exe | The specified executable is not a valid application for this OS platform.
|