File name:

81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e

Full analysis: https://app.any.run/tasks/e5442cbf-55df-434b-876c-b08238357d01
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 19:38:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

B1A393A7FECB4A43541C172E82918C24

SHA1:

4EC313C85BDFF9BB3E59F88B4837FB28357DD524

SHA256:

81491C1A4647D8BCEAB49D6A9A09080A66828805D5AFD5EFE566C17C9948827E

SSDEEP:

1536:nSSBOWDNzfyk22ATPLDZUeUbdh9ioY5KdpqKmY7:nSSBOuzfykmLD6eUbdJGz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)

    • ASYNCRAT has been detected (YARA)

      • lol.exe (PID: 8080)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)

    • Executing commands from a ".bat" file

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)

    • Starts CMD.EXE for commands execution

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7928)

    • The executable file from the user directory is run by the CMD process

      • lol.exe (PID: 8080)

    • Connects to unusual port

      • lol.exe (PID: 8080)

  • INFO

    • Reads the computer name

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)
      • lol.exe (PID: 8080)

    • Checks supported languages

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)
      • lol.exe (PID: 8080)

    • Creates files or folders in the user directory

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)

    • Reads the machine GUID from the registry

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)
      • lol.exe (PID: 8080)

    • Create files in a temporary directory

      • 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe (PID: 7640)

    • Reads Environment values

      • lol.exe (PID: 8080)

    • Reads the software policy settings

      • slui.exe (PID: 5720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(8080) lol.exe
C2 (1)sun-anime.gl.at.ply.gg
Ports (1)40252
Version
Options
AutoRuntrue
MutexيΑMQG尺德WHv吾ΒYΙJLΑtQvFQV
InstallFolder%AppData%
Certificates
Cert1MIICKTCCAZKgAwIBAgIVAMwN4ITHdUpXBYmqZdOjZ26Zw8mLMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwNjEyMDQzNTAzWhcNMzUwMzIyMDQzNTAzWjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA...
Server_SignatureaWZLxAAZJtaBYVDFtR/f6aLEPhKydmG9DR3ZqgB2Rzt/elvCUlqz2zN6RM3peMJMjiTnAFmUQ084Ut8ngXpIg77YSXPvmpaNrdmKOiDjlJnNw+iEcwXsFfCPaPzfaXZ+u2k//DKe8E3Z/bIkUU7EG2V4m1oXRgWjf1xq+Ro9NeI=
Keys
AESf7d58537a769ffec885a0f5d4076461f1d2bf782a330b6820eacee37455e8055
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:24 17:30:14+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 60416
InitializedDataSize: 4096
UninitializedDataSize: -
EntryPoint: 0x109fe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.6.0.0
ProductVersionNumber: 3.6.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 3.6.0.0
InternalName: Client.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: -
ProductVersion: 3.6.0.0
AssemblyVersion: 3.6.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT lol.exe svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5720C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7640"C:\Users\admin\Desktop\81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe" C:\Users\admin\Desktop\81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.6.0.0
Modules
Images
c:\users\admin\desktop\81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7928C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmpCBAE.tmp.bat""C:\Windows\System32\cmd.exe—81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
7936\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7976timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
8080"C:\Users\admin\AppData\Roaming\lol.exe" C:\Users\admin\AppData\Roaming\lol.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3.6.0.0
Modules
Images
c:\users\admin\appdata\roaming\lol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(8080) lol.exe
C2 (1)sun-anime.gl.at.ply.gg
Ports (1)40252
Version
Options
AutoRuntrue
MutexيΑMQG尺德WHv吾ΒYΙJLΑtQvFQV
InstallFolder%AppData%
Certificates
Cert1MIICKTCCAZKgAwIBAgIVAMwN4ITHdUpXBYmqZdOjZ26Zw8mLMA0GCSqGSIb3DQEBDQUAMF0xDjAMBgNVBAMMBUVCT0xBMRMwEQYDVQQLDApxd3FkYW5jaHVuMRwwGgYDVQQKDBNEY1JhdCBCeSBxd3FkYW5jaHVuMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjQwNjEyMDQzNTAzWhcNMzUwMzIyMDQzNTAzWjAQMQ4wDAYDVQQDDAVEY1JhdDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA...
Server_SignatureaWZLxAAZJtaBYVDFtR/f6aLEPhKydmG9DR3ZqgB2Rzt/elvCUlqz2zN6RM3peMJMjiTnAFmUQ084Ut8ngXpIg77YSXPvmpaNrdmKOiDjlJnNw+iEcwXsFfCPaPzfaXZ+u2k//DKe8E3Z/bIkUU7EG2V4m1oXRgWjf1xq+Ro9NeI=
Keys
AESf7d58537a769ffec885a0f5d4076461f1d2bf782a330b6820eacee37455e8055
SaltDcRatByqwqdanchun
Total events
4 064
Read events
4 063
Write events
1
Delete events
0

Modification events

(PID) Process:(7640) 81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:lol
Value:
"C:\Users\admin\AppData\Roaming\lol.exe"
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
764081491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exeC:\Users\admin\AppData\Roaming\lol.exeexecutable
MD5:B1A393A7FECB4A43541C172E82918C24
SHA256:81491C1A4647D8BCEAB49D6A9A09080A66828805D5AFD5EFE566C17C9948827E
764081491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e.exeC:\Users\admin\AppData\Local\Temp\tmpCBAE.tmp.battext
MD5:DF7478FEE3161D3E856540855F73B8C6
SHA256:362431200EC459FB6A5535518F369C5251CD76737422A2FA7E105915637BABD1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
52
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.182:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7284
SIHClient.exe
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7284
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
—
—
POST
200
40.126.31.1:443
https://login.live.com/RST2.srf
unknown
xml
1.35 Kb
whitelisted
—
—
POST
400
20.190.159.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
200
20.190.159.0:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
400
40.126.31.129:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
200
20.223.36.55:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250324T193847Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=29d585cc4b234a6f9e2ce53134988574&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3967898&metered=false&nettype=ethernet&npid=sc-310091&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&rver=2&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1358427&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
1.31 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
23.48.23.182:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7684
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
8080
lol.exe
147.185.221.26:40252
sun-anime.gl.at.ply.gg
PLAYIT-GG
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 216.58.212.174
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.1
  • 20.190.159.129
  • 40.126.31.131
  • 40.126.31.128
  • 20.190.159.4
  • 20.190.159.130
  • 20.190.159.2
whitelisted
crl.microsoft.com
  • 23.48.23.182
  • 23.48.23.177
  • 23.48.23.168
  • 23.48.23.161
  • 23.48.23.175
  • 23.48.23.181
  • 23.48.23.188
  • 23.48.23.189
  • 23.48.23.162
  • 88.221.110.122
  • 88.221.110.114
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
sun-anime.gl.at.ply.gg
  • 147.185.221.26
malicious
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
2196
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
81491c1a4647d8bceab49d6a9a09080a66828805d5afd5efe566c17c9948827e