File name:

b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7

Full analysis: https://app.any.run/tasks/c056bf72-6755-435f-866f-2a2455d0a946
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: October 19, 2023, 14:59:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
remote
rat
asyncrat
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

FBBD8FA745A4EFB592932F75386F14AE

SHA1:

8E1B5F54228C29A1914FB1D264A044C3E18255E4

SHA256:

E481C7F16652A25B6A13C8D1E1975A06D8029B9A49238FA4833BD4FB25BEC738

SSDEEP:

49152:TbB7etnD667rb/TdvO90d7HjmAFd4A64nsfJeJtzK2h7ymUO+JZiZ7S+UqT6gXed:i66zK25j6guuREIetXa+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe (PID: 1492)

    • Application was dropped or rewritten from another process

      • jsc.exe (PID: 1628)

    • ASYNCRAT has been detected (YARA)

      • jsc.exe (PID: 1628)

    • ASYNCRAT was detected

      • jsc.exe (PID: 1628)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe (PID: 1492)

    • Connects to unusual port

      • jsc.exe (PID: 1628)

    • Reads settings of System Certificates

      • jsc.exe (PID: 1628)

    • Searches for installed software

      • jsc.exe (PID: 1628)

    • Reads the Internet Settings

      • jsc.exe (PID: 1628)

  • INFO

    • Create files in a temporary directory

      • b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe (PID: 1492)
      • jsc.exe (PID: 1628)

    • Checks supported languages

      • b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe (PID: 1492)
      • jsc.exe (PID: 1628)

    • Reads the computer name

      • jsc.exe (PID: 1628)

    • Reads the machine GUID from the registry

      • jsc.exe (PID: 1628)

    • Reads Environment values

      • jsc.exe (PID: 1628)

    • Creates files or folders in the user directory

      • jsc.exe (PID: 1628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(1628) jsc.exe
C2 (2)127.0.0.1
20.211.121.138
Ports (1)4449
BotnetDefault
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.1
Options
AutoRunfalse
Mutexsnwzpdoojm
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAw...
Server_Signatureg2UtMQ91moX5RBUD/T3/0l5oe4029w191AyDsZPhA45yeiddD5nioxmfY7GySZrRZc9O3hT3I4wVXosJMU62xz0Pepc1d/8telcSrcMIcxEIyElHhQCj0iYzq3srjSAUigZREdKBX1FY6BK4UjVxW3gcHY6k4OjhDSWsgiQ9aD8=
Keys
AES97313d7683b179b4c3c29b4ca2a49634d75ffcb71f9055a9a7bf4761edfbc529
SaltVenomRATByVenom
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

SpecialBuild: -
ProductVersion: -
ProductName: -
PrivateBuild: -
OriginalFileName: -
LegalTrademarks: -
LegalCopyright: -
InternalName: -
FileVersion: -
FileDescription: -
CompanyName: -
Comments: -
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 6.1
ImageVersion: -
OSVersion: 6.1
EntryPoint: 0x14c0
UninitializedDataSize: 389632
InitializedDataSize: 8328192
CodeSize: 2766848
LinkerVersion: 2.36
PEType: PE32+
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
TimeStamp: 0000:00:00 00:00:00
MachineType: AMD AMD64
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
31
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe no specs #ASYNCRAT jsc.exe

Process information

PID
CMD
Path
Indicators
Parent process
1492"C:\Users\admin\AppData\Local\Temp\b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe" C:\Users\admin\AppData\Local\Temp\b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
666
Modules
Images
c:\users\admin\appdata\local\temp\b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\winmm.dll
1628C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
jsc.exe
Exit code:
0
Version:
14.7.2558.0 built by: NET471REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\jsc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\msvcrt.dll
AsyncRat
(PID) Process(1628) jsc.exe
C2 (2)127.0.0.1
20.211.121.138
Ports (1)4449
BotnetDefault
VersionVenom RAT + HVNC + Stealer + Grabber v6.0.1
Options
AutoRunfalse
Mutexsnwzpdoojm
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIICLzCCAZigAwIBAgIVAMlWIVjWC1nh9ktodokpLXg1Z7jDMA0GCSqGSIb3DQEBDQUAMGAxGDAWBgNVBAMMD1Zlbm9tUkFUIFNlcnZlcjEOMAwGA1UECwwFVmVub20xGjAYBgNVBAoMEVZlbm9tUkFUIEJ5IFZlbm9tMQswCQYDVQQHDAJTSDELMAkGA1UEBhMCQ04wHhcNMjIwNDIzMDE0ODMzWhcNMzMwMTMwMDE0ODMzWjATMREwDwYDVQQDDAhWZW5vbVJBVDCBnzANBgkqhkiG9w0BAQEFAAOBjQAw...
Server_Signatureg2UtMQ91moX5RBUD/T3/0l5oe4029w191AyDsZPhA45yeiddD5nioxmfY7GySZrRZc9O3hT3I4wVXosJMU62xz0Pepc1d/8telcSrcMIcxEIyElHhQCj0iYzq3srjSAUigZREdKBX1FY6BK4UjVxW3gcHY6k4OjhDSWsgiQ9aD8=
Keys
AES97313d7683b179b4c3c29b4ca2a49634d75ffcb71f9055a9a7bf4761edfbc529
SaltVenomRATByVenom
Total events
1 187
Read events
1 182
Write events
5
Delete events
0

Modification events

(PID) Process:(1628) jsc.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
2
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1492b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exeC:\Users\admin\AppData\Local\Temp\PhcZJGOjuZNLYIE.dataexecutable
MD5:B26E65E97DFCDB29A03BCEE8AA1D68B9
SHA256:4D2FF3E7ABEE65984B4AC8F6800BBAC243B8A751D3308E8508395F639E2A431F
1628jsc.exeC:\Users\admin\AppData\Local\Temp\Tar1A17.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
1628jsc.exeC:\Users\admin\AppData\Local\Temp\Cab1A16.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1628jsc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:A8098D9BA8A73987C0C5C44F432F4B59
SHA256:F9E38976A0F8BC6D8766E7757ED2AF33BF0435DC46E8532FA43F806D0FBA5455
1628jsc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1628jsc.exeC:\Users\admin\AppData\Roaming\MyData\DataLogs.conftext
MD5:CF759E4C5F14FE3EEC41B87ED756CEA8
SHA256:C9F9F193409217F73CC976AD078C6F8BF65D3AABCF5FAD3E5A47536D47AA6761
1492b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7.exeC:\Users\admin\AppData\Local\Temp\AgpWfoXnJMsddGX.dataexecutable
MD5:8F75F2319DCCCAE6528924842E7E06AE
SHA256:AAD871966E948E71390A506FEF3D6CFB1CD52B0C41BF04CB026FCAE02EDA8325
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
1
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1628
jsc.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5698fad49cd78d05
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1628
jsc.exe
20.211.121.138:4449
—
MICROSOFT-CORP-MSN-AS-BLOCK
AU
malicious
1628
jsc.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

PID
Process
Class
Message
1628
jsc.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] Possible AsyncRAT SSL Certificate
1628
jsc.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b24ee01804b7014bf78f5744b849f573473013443ca1d1b409491cb7