File name:

b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe

Full analysis: https://app.any.run/tasks/92d2e032-c57a-4ec2-aeee-3e1b623bd10e
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: February 28, 2024, 22:09:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

0BDC1B0A44429D769E00DE4F618F28DE

SHA1:

5CD180CC0C193D683D0D4D1DF6BB736D69979337

SHA256:

B6E9A92088C06053D47298A4F7D09DC1BDC34371BEE829AEBE157531B02FA9E5

SSDEEP:

3072:KuSSEuimcvlEKKasTXaGyOucCH1bfRbfmyr3IIHAf8LZJxy3E3Qsp7juA36Y:KbrdKasLaliCVb5bfMo7LI3kQMjhK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

    • ASYNCRAT has been detected (YARA)

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

  • SUSPICIOUS

    • Connects to unusual port

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

  • INFO

    • Checks supported languages

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

    • Reads the computer name

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

    • Creates files or folders in the user directory

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

    • Reads Environment values

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

    • Checks proxy server information

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)
      • slui.exe (PID: 5584)

    • Reads the machine GUID from the registry

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)

    • Reads the software policy settings

      • b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe (PID: 5280)
      • slui.exe (PID: 5584)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe
BotnetDefault
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRunfalse
Mutexybjufwvxthqiqqjouno
InstallFolder%tmp%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignaturefLsCQRTuWX4Z+kN51DYTn/s4qEpRMEX5IKu6h7HNsRi1QFPuJR9zdIzcCmAFIC2P2CLE5G9LJIsRn4YQmPqGlK6QCRM73b8IZgHhhSthxccxDOEZcRBz+UDXNKE9kpZq/tMxfUOAdkVIs3M+LcwKMVz+yl8mvSDjRPmpe5FvV/M=
Keys
AES2e97b6e260eacb93d6dddc734bf41adae80509661fbcb8968c5121a5771cc4a9
SaltVenomRATByVenom
Credentials
Protocolpastebin
URLhttps://pastebin.com/raw/ZQRGYcGR
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:08 22:10:28+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 71168
InitializedDataSize: 241152
UninitializedDataSize: -
EntryPoint: 0x1349e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.0.0.0
ProductVersionNumber: 6.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: EVLF - t.me/evlfdev
FileDescription: Craxs Rat v6
FileVersion: 6.0.0.0
InternalName: CraxsRat.exe
LegalCopyright: CraxsRat © 2023
LegalTrademarks: -
OriginalFileName: CraxsRat.exe
ProductName: Craxs Rat v6
ProductVersion: 6.0.0.0
AssemblyVersion: 6.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ASYNCRAT b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
5280"C:\Users\admin\AppData\Local\Temp\b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe" C:\Users\admin\AppData\Local\Temp\b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe
explorer.exe
User:
admin
Company:
EVLF - t.me/evlfdev
Integrity Level:
MEDIUM
Description:
Craxs Rat v6
Exit code:
0
Version:
6.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe
BotnetDefault
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.3
Options
AutoRunfalse
Mutexybjufwvxthqiqqjouno
InstallFolder%tmp%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICOTCCAaKgAwIBAgIVAPyfwFFMs6hxoSr1U5gHJmBruaj1MA0GCSqGSIb3DQEBDQUAMGoxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEfMB0GA1UECgwWVmVub21SQVQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTIyMDgxNDA5NDEwOVoXDTMzMDUyMzA5NDEwOVowEzERMA8GA1UEAwwIVmVub21SQVQwgZ8wDQYJKoZIhvcN...
Server_SignaturefLsCQRTuWX4Z+kN51DYTn/s4qEpRMEX5IKu6h7HNsRi1QFPuJR9zdIzcCmAFIC2P2CLE5G9LJIsRn4YQmPqGlK6QCRM73b8IZgHhhSthxccxDOEZcRBz+UDXNKE9kpZq/tMxfUOAdkVIs3M+LcwKMVz+yl8mvSDjRPmpe5FvV/M=
Keys
AES2e97b6e260eacb93d6dddc734bf41adae80509661fbcb8968c5121a5771cc4a9
SaltVenomRATByVenom
Credentials
Protocolpastebin
URLhttps://pastebin.com/raw/ZQRGYcGR
5584C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
1 466
Read events
1 452
Write events
14
Delete events
0

Modification events

(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5280) b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5280b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exeC:\Users\admin\AppData\Roaming\MyData\DataLogs.conftext
MD5:CF759E4C5F14FE3EEC41B87ED756CEA8
SHA256:C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
37
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5928
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
4252
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.01 Kb
unknown
6160
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
2464
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4252
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5928
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6896
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3848
svchost.exe
239.255.255.250:1900
—
—
—
unknown
5280
b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
5280
b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe
172.111.139.95:7771
—
M247 Ltd
US
unknown
5928
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5928
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
shared
login.live.com
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.23
  • 20.190.159.73
  • 40.126.31.71
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.bing.com
  • 95.101.27.67
  • 95.101.27.96
  • 95.101.27.101
  • 95.101.27.105
  • 95.101.27.122
  • 95.101.27.73
  • 95.101.27.91
  • 95.101.27.77
  • 95.101.27.118
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
18.31.95.13.in-addr.arpa
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5.exe