File name:

dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91

Full analysis: https://app.any.run/tasks/6c0c3b49-f63c-4ca7-8a58-e7098de28f11
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 19:32:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
neshta
auto
rat
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

4AA312537E1070C0973034182E93661A

SHA1:

554A11BB09A19B930254510684EB9338B8483ACD

SHA256:

DBF6A6E0987772661CBEBB257CEC32039D6A1782D1DDB6186F0988B552DEDB91

SSDEEP:

98304:xQGQxR65spi6Cp95eCH7f2PEsqolNoWvEynjLSoiLCpJvqjE1nepKbj:NQcRxk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been found (auto)

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7600)

    • Actions looks like stealing of personal data

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)

    • Executing a file with an untrusted certificate

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7600)
      • FileCoAuth.exe (PID: 8020)

    • ASYNCRAT has been detected (YARA)

      • InstallUtil.exe (PID: 7756)

    • NESHTA mutex has been found

      • FileCoAuth.exe (PID: 7972)
      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • FileCoAuth.exe (PID: 7972)
      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7600)

    • Mutex name with non-standard characters

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • FileCoAuth.exe (PID: 7972)

    • Reads security settings of Internet Explorer

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • FileCoAuth.exe (PID: 7972)

    • Connects to unusual port

      • InstallUtil.exe (PID: 7756)

    • There is functionality for taking screenshot (YARA)

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)

    • Process drops legitimate windows executable

      • FileCoAuth.exe (PID: 7972)

    • Starts a Microsoft application from unusual location

      • FileCoAuth.exe (PID: 8020)

  • INFO

    • Create files in a temporary directory

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • FileCoAuth.exe (PID: 8020)

    • Reads the machine GUID from the registry

      • InstallUtil.exe (PID: 7756)
      • FileCoAuth.exe (PID: 8020)
      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7600)

    • Manual execution by a user

      • InstallUtil.exe (PID: 7756)

    • Process checks computer location settings

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • FileCoAuth.exe (PID: 7972)

    • Checks supported languages

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7600)
      • FileCoAuth.exe (PID: 8020)
      • InstallUtil.exe (PID: 7756)

    • Reads the computer name

      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7556)
      • dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe (PID: 7600)
      • FileCoAuth.exe (PID: 8020)
      • InstallUtil.exe (PID: 7756)

    • The sample compiled with english language support

      • FileCoAuth.exe (PID: 7972)

    • Creates files or folders in the user directory

      • FileCoAuth.exe (PID: 8020)

    • Checks proxy server information

      • slui.exe (PID: 8124)

    • Reads the software policy settings

      • slui.exe (PID: 8124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(7756) InstallUtil.exe
C2 (1)45.74.34.32
Ports (1)1994
Version0.5.7B
BotnetPatch
Options
AutoRunfalse
MutexFGTRDSGDFBGGSDFG_S5S54SDF
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQALBkRuNCTqKtgapRE9OFfzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjEwOTA4MTcxOTA2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIUy6LUKGJiU+zs5YT6bYIiVfLqLpcI+LU0E4VJAwp9P6glbx/vcYicyK5/XI6drbESmiYtKXn2S...
Server_SignatureW72vJksRSx6lmDx744qZdaKBL9LZNrTxIBXWDKmEJ5AjW6VIlQCT/DL6/mPHKVI6Df1Ly+TS9TJfumAbUpVj9bR1HYg123rULN5wpijaJLq3Jk1LoUimjwbnUa2Fa3JJt85A5lR5vxeSKEgI8dh+4ql/xaRypKjjdeYNzo60kiZ8dXTSa9ngsapGU2kmOrgLxm+9roJ9j3i09LLLQq0AUexXynOeto1t0Ryq8T1ObBMKNc7B66taeTzVMTCKt7DbyZMPmK7auH885d1ng8VADlI3n8gpGif9TZYJIqph7x7e...
Keys
AES92bbd7f8fb368dd17af409aaa5f08637b50989eee3c9b337e4c12496f520f56d
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 6 (85.5)
.exe | Win32 Executable Delphi generic (4.6)
.scr | Windows screen saver (4.2)
.dll | Win32 Dynamic Link Library (generic) (2.1)
.exe | Win32 Executable (generic) (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 29696
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0x80e4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #NESHTA dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe #ASYNCRAT dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe #ASYNCRAT installutil.exe filecoauth.exe no specs filecoauth.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7556"C:\Users\admin\Desktop\dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe" C:\Users\admin\Desktop\dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7600"C:\Users\admin\AppData\Local\Temp\3582-490\dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe" C:\Users\admin\AppData\Local\Temp\3582-490\dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe
dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
4294967295
Version:
6.24.0.0
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7756"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AsyncRat
(PID) Process(7756) InstallUtil.exe
C2 (1)45.74.34.32
Ports (1)1994
Version0.5.7B
BotnetPatch
Options
AutoRunfalse
MutexFGTRDSGDFBGGSDFG_S5S54SDF
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQALBkRuNCTqKtgapRE9OFfzANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjEwOTA4MTcxOTA2WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIUy6LUKGJiU+zs5YT6bYIiVfLqLpcI+LU0E4VJAwp9P6glbx/vcYicyK5/XI6drbESmiYtKXn2S...
Server_SignatureW72vJksRSx6lmDx744qZdaKBL9LZNrTxIBXWDKmEJ5AjW6VIlQCT/DL6/mPHKVI6Df1Ly+TS9TJfumAbUpVj9bR1HYg123rULN5wpijaJLq3Jk1LoUimjwbnUa2Fa3JJt85A5lR5vxeSKEgI8dh+4ql/xaRypKjjdeYNzo60kiZ8dXTSa9ngsapGU2kmOrgLxm+9roJ9j3i09LLLQq0AUexXynOeto1t0Ryq8T1ObBMKNc7B66taeTzVMTCKt7DbyZMPmK7auH885d1ng8VADlI3n8gpGif9TZYJIqph7x7e...
Keys
AES92bbd7f8fb368dd17af409aaa5f08637b50989eee3c9b337e4c12496f520f56d
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
7972C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
8020"C:\Users\admin\AppData\Local\Temp\3582-490\FileCoAuth.exe" -EmbeddingC:\Users\admin\AppData\Local\Temp\3582-490\FileCoAuth.exe—FileCoAuth.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\temp\3582-490\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
8124C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 467
Read events
4 467
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7556dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\ProgramData\Adobe\ARM\S\388\AdobeARMHelper.exeexecutable
MD5:85A67D34298E33D2D5A9EC789B6AB594
SHA256:1DEE143B4F88F2375B85C6271A58E2E78FED081BEAE4090678CB2DD7A37FB2D4
7600dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\prosecce.vbstext
MD5:5DD40810B4AB8B13BA232CB200F6EDBF
SHA256:46C3FDC022FA1382E04DE628BA7DFFAA7DF498571C2805D6B3BF8A6A55F006D1
7556dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Local\Temp\3582-490\dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeexecutable
MD5:DA7D0731577455065521C84834D16BFB
SHA256:24FFFC42C2C512A729089FE6C8F2BD75F9BC697305911448E2C2FE5A5CFDC33C
7600dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Roaming\prosecce.exeexecutable
MD5:DA7D0731577455065521C84834D16BFB
SHA256:24FFFC42C2C512A729089FE6C8F2BD75F9BC697305911448E2C2FE5A5CFDC33C
7556dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exeexecutable
MD5:178B773B3FB050FCE26E40A9E8C2EE9A
SHA256:1E03573733F25B44004049A535E7E79366FD86FE953F6DFEDAAD05513B46A6C5
7556dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileSyncConfig.exeexecutable
MD5:0C5EC1AE9A301408AF26032B445FBB08
SHA256:3A8010F1E4E028782093877D969EB127B80AE48B7215A8D3F91E8AB9C165AC7A
7556dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exeexecutable
MD5:A747FA4161FE3C00C3FBB4BF391D4D4E
SHA256:B7BA59428AF7AE08C5BF927B57E326D5259E6ED31BD4237AA6A44378177364C1
7556dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileSyncHelper.exeexecutable
MD5:1C0BE16E6ED8F5B6F0910650A25F4FA7
SHA256:3028F6A6A7A10DC5D63F256FEEB8275F3818BF3371EAF8B20A2D0BF2FCD5F4A9
7556dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91.exeC:\Users\admin\AppData\Local\Temp\tmp5023.tmptext
MD5:8EF484C3A613A01E6969D0029A024BEB
SHA256:1E5BB69E0252B885AEDB765DA6DFEBBCB5FEED2E1B2B63D71747AB7E2AB06E18
8020FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-04-15.1932.8020.1.aodlbinary
MD5:28DCA2FF4B34B5A52A2E59DF202A6ED3
SHA256:33BACCB7296F1ED1F995FC77A23049F261CF391AC0388F9E8DD161F8C17B7F94
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
46
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7756
InstallUtil.exe
45.74.34.32:1994
—
M247 Ltd
US
unknown
7292
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8124
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dbf6a6e0987772661cbebb257cec32039d6a1782d1ddb6186f0988b552dedb91