AsyncRAT PE Executable malware analysis – 47ec550416d5

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

50.18 KB · 50,176 B

First seen

2026-10-05 07:15 · 20 days ago

Last seen

2026-10-05 07:15 · 20 days ago

Last analysis

2026-10-05 07:15 · 20 days ago

Hashes

MD5 c61337c8ddc16d4c2d5cbb35bb1211cf Sha1 036f1d11d4b3af6c3086ae47560af100e0e34f37 Sha256 47ec550416d5740d5593508bd7088f26f1e7053cecd10851c2f15fb38e3fbd6d Sha384 76fd9a93eb5abfc76c8133e2d2732a141c53280cabcfee8f3f5350e376a4ace5ae893cf36e6e81aee04267f5f66ad1a3 Sha512 f56cd2e5b3ee1bcdaf68adf885cd33c07db2a6cba132b44fe082d72df3e34bd2e6367f985821253fc070afb4909230782135e77561dfd38366da702cedca8f8d SSDeep 768:NozqM7wdcb64GBklNDQ0piTYlCx0ZuTtN0bBTmHL8XrTIh/YFIvClZU2tYcFmVcl:NozqME+08g10JbBi8rTIgrUKmVcl TLSH AF333B103BE9812BE2BE4B786DF21641867BF1673603D94A3CC841D75B13BC696429FE

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 3 files

EXEc61337c8ddc16d4c2d5cbb35bb1211cfAsyncRAT

Structure

BINResources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	WFZWUGhuhuhuhuhuhuhuhuhuhuhu
Pastebin	-huhuhuhu
Certificate	MIIE8jhuhuhuhuhuhuhuhuhuhuhu
ServerSignature	kNyXG+huhuhuhuhuhuhuhuhuhuhu
Install	thuhuhuhu
BDOS	thuhuhuhu
Anti-VM	thuhuhuhu
Install File	mkhuhuhuhu
Install-Folder	%Aphuhuhuhu
Version	0.huhuhuhu
Hosts	knhuhuhuhu
Ports	4huhuhuhu
Mutex	fgygzhuhuhuhuhuhuhu
Delay	1huhuhuhu
Group	knhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	mKdlXCxbzUwgQzO
Full Name	mKdlXCxbzUwgQzO
EntryPoint	System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Scope Name	mKdlXCxbzUwgQzO
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	crackexe
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	121
Main Method	System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::zxAnIGyjoCvxQFy call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ViEdMbLuTl.fltkJzfDMEfbq::qcoGvudxEUvgv() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bGaKtCeCbxwo.XwWOUxgFFrfGCfN::nQLHacPysmtmfbL() brtrue IL_0043: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy call System.Void bGaKtCeCbxwo.qBbUZaLhdSmFPUv::dnTCmDtNEnvj() ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG call System.Void hSnGtgXaSZNiG.rAibaxVelIPXgTZv::SNgALWxaCYFbo() ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc() call System.Boolean bGaKtCeCbxwo.cfHEkLQgNxx::DlJZdqZMGlPtBTGI() brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc() call System.Void bGaKtCeCbxwo.dqdjAlkITS::FDTdPnmPoaAgGaF() call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc() leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected() pop <null> leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected() call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected() brtrue IL_00AD: newobj System.Void System.Random::.ctor() call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::hthoQZwDxtxu() call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::aeYbSlXJVyxQmPfko() newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()
Module Name	mKdlXCxbzUwgQzO
Full Name	mKdlXCxbzUwgQzO
EntryPoint	System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Scope Name	mKdlXCxbzUwgQzO
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	crackexe
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	121
Main Method	System.Void ViEdMbLuTl.rRWehRWSzOKL::Main()
Main IL Instruction Count	50
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::zxAnIGyjoCvxQFy call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean ViEdMbLuTl.fltkJzfDMEfbq::qcoGvudxEUvgv() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean bGaKtCeCbxwo.XwWOUxgFFrfGCfN::nQLHacPysmtmfbL() brtrue IL_0043: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::muEwEOGDuot call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy call System.Void bGaKtCeCbxwo.qBbUZaLhdSmFPUv::dnTCmDtNEnvj() ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::ccgcrbsFiNjy call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG call System.Void hSnGtgXaSZNiG.rAibaxVelIPXgTZv::SNgALWxaCYFbo() ldsfld System.String ViEdMbLuTl.fltkJzfDMEfbq::WlDgLyfHTQG call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc() call System.Boolean bGaKtCeCbxwo.cfHEkLQgNxx::DlJZdqZMGlPtBTGI() brfalse IL_0089: call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc() call System.Void bGaKtCeCbxwo.dqdjAlkITS::FDTdPnmPoaAgGaF() call System.Void bGaKtCeCbxwo.cfHEkLQgNxx::ZeNqsDBtzc() leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected() pop <null> leave IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected() call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected() brtrue IL_00AD: newobj System.Void System.Random::.ctor() call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::hthoQZwDxtxu() call System.Void OhpjYdRoDEzDJo.rpXYFyiCjiIYM::aeYbSlXJVyxQmPfko() newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: call System.Boolean OhpjYdRoDEzDJo.rpXYFyiCjiIYM::get_IsConnected()

Key (AES_256) MUTEXmalicious

WFZWUGhuhuhuhuhuhuhuhuhuhuhu

CnC CNCmalicious

knhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

fgygzhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential