File name:

4Has_F64.zip

Full analysis: https://app.any.run/tasks/b963874a-b415-4a81-8f5a-24ec83d7b0ca
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: September 04, 2025, 19:34:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
hijackloader
loader
rat
asyncrat
remote
dcrat
amsi-bypass
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

4A87CFC91192E90C075E2E7A0B4FC6FE

SHA1:

9059F7BC168304BB53F3AB118C5376E105582B06

SHA256:

7F3F01810868C1761DEB55178F41373F6075F8A5F12AC0CEF014973CCF948A1F

SSDEEP:

98304:X5VdISidItypzM2vWdLM8tlBQdCfkkGJbHrgow4/Nc1iwdK7THmUYdlLGe/nEB3V:a7QCp/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4744)
    • Executing a file with an untrusted certificate

      • Has_F64.exe (PID: 4680)
      • Has_F64.exe (PID: 6236)
      • Has_F64.exe (PID: 1352)
      • Has_F64.exe (PID: 3964)
    • HIJACKLOADER has been detected (YARA)

      • Has_F64.exe (PID: 6236)
      • Has_F64.exe (PID: 3964)
    • DCRAT mutex has been found

      • StreamVa.exe (PID: 3896)
    • ASYNCRAT has been detected (SURICATA)

      • StreamVa.exe (PID: 3896)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4744)
      • Has_F64.exe (PID: 4680)
    • Starts itself from another location

      • Has_F64.exe (PID: 4680)
      • Has_F64.exe (PID: 1352)
    • The process drops C-runtime libraries

      • Has_F64.exe (PID: 4680)
    • Executable content was dropped or overwritten

      • Has_F64.exe (PID: 4680)
      • Has_F64.exe (PID: 6236)
    • There is functionality for taking screenshot (YARA)

      • StreamVa.exe (PID: 3896)
      • StreamVa.exe (PID: 6292)
    • Contacting a server suspected of hosting an CnC

      • StreamVa.exe (PID: 3896)
    • Connects to unusual port

      • StreamVa.exe (PID: 3896)
    • Possibly patching Antimalware Scan Interface function (YARA)

      • StreamVa.exe (PID: 6292)
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4744)
    • The sample compiled with english language support

      • WinRAR.exe (PID: 4744)
      • Has_F64.exe (PID: 4680)
      • Has_F64.exe (PID: 6236)
    • Manual execution by a user

      • Has_F64.exe (PID: 4680)
      • Has_F64.exe (PID: 1352)
    • Reads the computer name

      • Has_F64.exe (PID: 4680)
      • Has_F64.exe (PID: 6236)
      • Has_F64.exe (PID: 1352)
      • StreamVa.exe (PID: 3896)
      • StreamVa.exe (PID: 6292)
      • Has_F64.exe (PID: 3964)
      • Chime.exe (PID: 5564)
      • Chime.exe (PID: 5904)
    • Checks supported languages

      • Has_F64.exe (PID: 4680)
      • Has_F64.exe (PID: 6236)
      • Has_F64.exe (PID: 1352)
      • StreamVa.exe (PID: 3896)
      • Chime.exe (PID: 5564)
      • Has_F64.exe (PID: 3964)
      • StreamVa.exe (PID: 6292)
      • Chime.exe (PID: 5904)
    • Creates files in the program directory

      • Has_F64.exe (PID: 4680)
    • Creates files or folders in the user directory

      • Has_F64.exe (PID: 6236)
    • Create files in a temporary directory

      • Has_F64.exe (PID: 6236)
      • Has_F64.exe (PID: 3964)
    • The sample compiled with chinese language support

      • Has_F64.exe (PID: 6236)
    • Reads the machine GUID from the registry

      • StreamVa.exe (PID: 3896)
    • Reads the software policy settings

      • StreamVa.exe (PID: 3896)
      • slui.exe (PID: 7140)
    • Checks proxy server information

      • slui.exe (PID: 7140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:09:04 08:49:36
ZipCRC: 0x2ac6fe52
ZipCompressedSize: 1728490
ZipUncompressedSize: 1836794
ZipFileName: Piegstoondpreek.xp
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
11
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe has_f64.exe #HIJACKLOADER has_f64.exe #ASYNCRAT streamva.exe has_f64.exe #HIJACKLOADER has_f64.exe no specs slui.exe streamva.exe no specs svchost.exe chime.exe no specs chime.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1352"C:\Users\admin\Desktop\Has_F64.exe" C:\Users\admin\Desktop\Has_F64.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
RegLibs MFC Application
Exit code:
0
Version:
1, 0, 0, 23
Modules
Images
c:\users\admin\desktop\has_f64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3896C:\Users\admin\StreamVa.exeC:\Users\admin\StreamVa.exe
Has_F64.exe
User:
admin
Company:
360.cn
Integrity Level:
MEDIUM
Description:
SysCleanPro Application
Version:
1.0.0.1101
Modules
Images
c:\users\admin\appdata\local\temp\60a37ff.tmp
c:\users\admin\streamva.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3964C:\ProgramData\SyStreamv2\Has_F64.exeC:\ProgramData\SyStreamv2\Has_F64.exe
Has_F64.exe
User:
admin
Integrity Level:
HIGH
Description:
RegLibs MFC Application
Exit code:
0
Version:
1, 0, 0, 23
Modules
Images
c:\programdata\systreamv2\has_f64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\programdata\systreamv2\mfc110u.dll
c:\windows\system32\win32u.dll
c:\windows\system32\advapi32.dll
c:\programdata\systreamv2\msvcr110.dll
4680"C:\Users\admin\Desktop\Has_F64.exe" C:\Users\admin\Desktop\Has_F64.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RegLibs MFC Application
Exit code:
0
Version:
1, 0, 0, 23
Modules
Images
c:\users\admin\desktop\has_f64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4744"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\4Has_F64.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5564C:\Users\admin\AppData\Local\SyStreamv2\Chime.exeC:\Users\admin\AppData\Local\SyStreamv2\Chime.exeHas_F64.exe
User:
admin
Company:
Amazon.com Services LLC
Integrity Level:
MEDIUM
Description:
Amazon Chime
Exit code:
0
Version:
5.23.32022
Modules
Images
c:\windows\syswow64\pla.dll
c:\users\admin\appdata\local\systreamv2\chime.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5904C:\Users\admin\AppData\Local\SyStreamv2\Chime.exeC:\Users\admin\AppData\Local\SyStreamv2\Chime.exeHas_F64.exe
User:
admin
Company:
Amazon.com Services LLC
Integrity Level:
HIGH
Description:
Amazon Chime
Exit code:
0
Version:
5.23.32022
Modules
Images
c:\windows\syswow64\pla.dll
c:\users\admin\appdata\local\systreamv2\chime.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6236C:\ProgramData\SyStreamv2\Has_F64.exeC:\ProgramData\SyStreamv2\Has_F64.exe
Has_F64.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RegLibs MFC Application
Exit code:
0
Version:
1, 0, 0, 23
Modules
Images
c:\programdata\systreamv2\has_f64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6292C:\Users\admin\StreamVa.exeC:\Users\admin\StreamVa.exeHas_F64.exe
User:
admin
Company:
360.cn
Integrity Level:
HIGH
Description:
SysCleanPro Application
Exit code:
0
Version:
1.0.0.1101
Modules
Images
c:\users\admin\appdata\local\temp\658916a.tmp
c:\users\admin\streamva.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
7 962
Read events
7 942
Write events
20
Delete events
0

Modification events

(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\4Has_F64.zip
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4744) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
10
Suspicious files
10
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6236Has_F64.exeC:\Users\admin\AppData\Local\Temp\60A37FF.tmp
MD5:
SHA256:
3964Has_F64.exeC:\Users\admin\AppData\Local\Temp\658916A.tmp
MD5:
SHA256:
4744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4744.13903\Piegstoondpreek.xpbinary
MD5:F7F3F81AA8A508E11376EE54BD426B8C
SHA256:37BCCF63C3EAB48298A6F9E9E84D931DA21BF0FB20667AB5431E69AD07005109
4744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4744.13903\MSVCR110.dllexecutable
MD5:7C3B449F661D99A9B1033A14033D2987
SHA256:AE996EDB9B050677C4F82D56092EFDC75F0ADDC97A14E2C46753E2DB3F6BD732
4680Has_F64.exeC:\ProgramData\SyStreamv2\Piegstoondpreek.xpbinary
MD5:F7F3F81AA8A508E11376EE54BD426B8C
SHA256:37BCCF63C3EAB48298A6F9E9E84D931DA21BF0FB20667AB5431E69AD07005109
4744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4744.13903\Has_F64.exeexecutable
MD5:285AF5DF9E15CD1467966E50E4A933F8
SHA256:C2A2846F3775E641218CE24189E795ACBAC3562D7B2F0F27A4E08F43173898C1
4680Has_F64.exeC:\ProgramData\SyStreamv2\Has_F64.exeexecutable
MD5:285AF5DF9E15CD1467966E50E4A933F8
SHA256:C2A2846F3775E641218CE24189E795ACBAC3562D7B2F0F27A4E08F43173898C1
4744WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4744.13903\Drub.rqobinary
MD5:AF34F45183EB84CAD53DC027B701F78A
SHA256:F2B6507ABC5F504B33DCCDC8573244D62B6079A863B1EFB066AB9518061C48E4
4680Has_F64.exeC:\ProgramData\SyStreamv2\Drub.rqobinary
MD5:AF34F45183EB84CAD53DC027B701F78A
SHA256:F2B6507ABC5F504B33DCCDC8573244D62B6079A863B1EFB066AB9518061C48E4
6236Has_F64.exeC:\Users\admin\AppData\Local\SyStreamv2\Chime.exeexecutable
MD5:DD65B976D1865BA6C2368FCF9C9EB223
SHA256:ADB8347DFA1B1DF1CA2211FE4D7E82F27CED939F1BF3D52548E52BC9E23FC52C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1268
svchost.exe
GET
200
23.3.109.244:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
4892
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6748
SIHClient.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6748
SIHClient.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
2940
svchost.exe
GET
200
23.3.109.48:80
http://x1.c.lencr.org/
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1948
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.3.109.244:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4892
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.3.109.244
  • 104.79.89.142
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.72
  • 20.190.160.22
  • 20.190.160.5
  • 40.126.32.133
  • 20.190.160.14
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
self.events.data.microsoft.com
  • 20.189.173.7
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.dynuddns .net Domain
3896
StreamVa.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
3896
StreamVa.exe
A Network Trojan was detected
ET MALWARE Observed Malicious SSL Cert (Various RAT)
3896
StreamVa.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT)
3896
StreamVa.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info