File name:

2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.zip

Full analysis: https://app.any.run/tasks/8ee4c16d-29de-4b08-91aa-827ae7bac460
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 04:12:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
asyncrat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

EFC7530D8A6D91CB6AB3EE4C9C8D78F4

SHA1:

1C0CA8F7D96571E4D80421A49AA1E652F5DD5CBA

SHA256:

C9B3BBE8F8E80C6E36BCC5B22ECF87AA6D34D09405F7B391663769F7D95653A6

SSDEEP:

49152:lHJJrKdnT422ip2CgZmC8cA39JA1tCiAZTCu3oyOXFwByK91UJebxVW1stzJTMzz:JrOTz2kFRpcA3wmZTCu3o3VwD1UMdV6N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5216)

    • ASYNCRAT has been detected (YARA)

      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 4944)

    • Create files in the Startup directory

      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 4944)

  • SUSPICIOUS

    • Connects to unusual port

      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 4944)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5216)

  • INFO

    • Checks supported languages

      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 4944)
      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 5548)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5216)

    • Creates files or folders in the user directory

      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 4944)

    • Reads the machine GUID from the registry

      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 4944)
      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 5548)

    • Reads the computer name

      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 5548)
      • 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe (PID: 4944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(4944) 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe
C2 (20)hsjafklweqmn.click
qweiozmnxvla.click
lkjzmxnqpwer.click
asdkjczxmeuw.click
zxvnqwejlkgh.click
mznvqiweurty.click
plmzxqwieruo.click
vxmnsdkjweqz.click
qpwalskdjzmx.click
zmxncvaoiwqe.click
xnzwoeirplad.click
qwenmzlxktyu.click
nmasdqwpeiru.click
qowuensmzxcv.click
wqemzxncpiou.click
zbqwmnzxopru.click
xpoiwnzqlaks.click
qpeuwmxnzvka.click
zcnvqpweoriu.click
lksmzqwenxop.click
Ports (1)7777
VersionLoaderPanel
Options
AutoRunfalse
Mutexgtyyopygoktauikhohh
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVALJH4bdfPPE5dyMevD9KJERdSx3xMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDExvYWRlciBQYW5lbDETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDczMDE2NDgyM1oXDTM1MDUwOTE2NDgyM1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureYlcdsPpKf11Hcp9qDaJrUQs5j2AxY6xgII8uWL2m7KZXKwMnTXAZomPx5X7u6Tc/YncDJCnsMHalwe9SkKLF+CSYONacxvQBplBXWUxD6Dru9KZ20fHUoplm4QrI789zZX8VqvU+Linwu43caEoZQdIkahIjtmX4hsARxzuLavk=
Keys
AESec7decd80617706721f853787f64b4588146586209029b7039884b7c3be7d885
SaltLoaderPanel
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:13 07:21:22
ZipCRC: 0x038ae365
ZipCompressedSize: 1479602
ZipUncompressedSize: 1562624
ZipFileName: 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs #ASYNCRAT 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2320C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
4944"C:\Users\admin\AppData\Local\Temp\Rar$EXb5216.36932\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb5216.36932\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe
WinRAR.exe
User:
admin
Company:
CxApp
Integrity Level:
MEDIUM
Description:
CxApp
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb5216.36932\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(4944) 2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe
C2 (20)hsjafklweqmn.click
qweiozmnxvla.click
lkjzmxnqpwer.click
asdkjczxmeuw.click
zxvnqwejlkgh.click
mznvqiweurty.click
plmzxqwieruo.click
vxmnsdkjweqz.click
qpwalskdjzmx.click
zmxncvaoiwqe.click
xnzwoeirplad.click
qwenmzlxktyu.click
nmasdqwpeiru.click
qowuensmzxcv.click
wqemzxncpiou.click
zbqwmnzxopru.click
xpoiwnzqlaks.click
qpeuwmxnzvka.click
zcnvqpweoriu.click
lksmzqwenxop.click
Ports (1)7777
VersionLoaderPanel
Options
AutoRunfalse
Mutexgtyyopygoktauikhohh
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVALJH4bdfPPE5dyMevD9KJERdSx3xMA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDExvYWRlciBQYW5lbDETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI0MDczMDE2NDgyM1oXDTM1MDUwOTE2NDgyM1owEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureYlcdsPpKf11Hcp9qDaJrUQs5j2AxY6xgII8uWL2m7KZXKwMnTXAZomPx5X7u6Tc/YncDJCnsMHalwe9SkKLF+CSYONacxvQBplBXWUxD6Dru9KZ20fHUoplm4QrI789zZX8VqvU+Linwu43caEoZQdIkahIjtmX4hsARxzuLavk=
Keys
AESec7decd80617706721f853787f64b4588146586209029b7039884b7c3be7d885
SaltLoaderPanel
5216"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5548"C:\Users\admin\AppData\Local\Temp\Rar$EXb5216.38395\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb5216.38395\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe—WinRAR.exe
User:
admin
Company:
CxApp
Integrity Level:
MEDIUM
Description:
CxApp
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb5216.38395\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6480"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
2 746
Read events
2 735
Write events
11
Delete events
0

Modification events

(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.zip
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5216) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5216WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb5216.38395\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exeexecutable
MD5:7A8C56C8CC95F823948B8F0D38A0B962
SHA256:2C53A10D0A5DF753DFE9633FE5493C03CEE5084BB753A135A2058DEA6451D6FE
5216WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb5216.36932\2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exeexecutable
MD5:7A8C56C8CC95F823948B8F0D38A0B962
SHA256:2C53A10D0A5DF753DFE9633FE5493C03CEE5084BB753A135A2058DEA6451D6FE
49442c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.urlurl
MD5:4B21DCF7C6AE610BD4B1F79B70DFCD17
SHA256:9C891E9DC6FECE95B44BB64123F89DDEAB7C5EFC95BF071FB4457996050F10A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6048
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6048
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6048
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.128
  • 20.190.159.75
  • 20.190.159.130
  • 40.126.31.130
  • 20.190.159.71
  • 20.190.159.129
  • 40.126.31.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
vxmnsdkjweqz.click
  • —
unknown
zcnvqpweoriu.click
  • —
unknown
qpeuwmxnzvka.click
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2c53a10d0a5df753dfe9633fe5493c03cee5084bb753a135a2058dea6451d6fe.zip