File name:

SecuriteInfo.com.Win64.Evo-gen.20212.7823

Full analysis: https://app.any.run/tasks/1d13f965-d8ab-40c4-973c-84a43c093311
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: February 11, 2025, 10:42:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
asyncrat
remote
stealer
purehvnc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 11 sections
MD5:

F3B99592F40E424A2FB51E8F60B98077

SHA1:

206C9919D5126B15925414EB3F7DE3ED253B9632

SHA256:

933F8677F0D485DC6CF8DC80434675F0B4B62721F3F8EA36D8985B95F1591411

SSDEEP:

24576:Tksi7TkShLhJf43pnYFf9EvV0XR8lpJ1zNOXJv:Tksi7wShjGpSf9EvV0XR8lpJ1zNOXJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • ASYNCRAT has been detected (SURICATA)

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • PUREHVNC has been detected (YARA)

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • Actions looks like stealing of personal data

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
  • SUSPICIOUS

    • Contacting a server suspected of hosting an CnC

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • Connects to unusual port

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
  • INFO

    • The sample compiled with english language support

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • Checks supported languages

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • Reads Environment values

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • Reads the computer name

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
    • Reads the software policy settings

      • SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe (PID: 6544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2007:05:01 05:32:37+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.43
CodeSize: 352256
InitializedDataSize: 885248
UninitializedDataSize: 1024
EntryPoint: 0x13c0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 9.73.77.8986
ProductVersionNumber: 9.73.77.8986
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 9.73.77.8986
ProductVersion: 9.73.77.8986
LegalTrademarks: Sarcastic_Setup.exe is a trademark of Sarcastic_Setup.exe Systems
ProductName: Sarcastic_Setup.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ASYNCRAT securiteinfo.com.win64.evo-gen.20212.7823.exe

Process information

PID
CMD
Path
Indicators
Parent process
6544"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
9.73.77.8986
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win64.evo-gen.20212.7823.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
3 287
Read events
3 287
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
27
DNS requests
14
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6564
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
6564
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6408
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
20.73.194.208:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1076
svchost.exe
2.19.106.8:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6544
SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe
93.88.203.169:56001
Dravanet Co Ltd.
HU
malicious
3296
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
go.microsoft.com
  • 2.19.106.8
whitelisted
login.live.com
  • 20.190.160.2
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.65
  • 20.190.160.17
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
6544
SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
6544
SecuriteInfo.com.Win64.Evo-gen.20212.7823.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info