AsyncRAT PE Executable malware analysis – 9ba76ceb13a6

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

28.16 KB · 28,160 B

First seen

2026-09-06 20:00 · one month ago

Last seen

2026-09-06 20:00 · one month ago

Last analysis

2026-09-06 20:00 · one month ago

Hashes

MD5 cdbde70e7dd779cebec7d5afb272da96 Sha1 3b930db64e5478fa38d42d5c20e9efa75dbe7489 Sha256 9ba76ceb13a62e632b94324fc772d7921c461c6fd5e70844aadca97dcc15cb7a Sha384 ab7b6d8e8209e2a4326c641bf0bd250e667b04b4a08d3d48be4683e405252d4585838b55ee01cae41c07ab2f8e0d7397 Sha512 bece2d67234d61fd01425df5257481764b30b8d42d4e14e4647f6bbba60aa283de8231b2490d3183f5d8b6a8f426610688877fce0f246d701ac8fb972382c81c SSDeep 384:zQpwoOiZTWqSOsVa/KFHbx0yH9qbuUscCbQxnCJfJBndnjJeKWjT+:zQpVg1VDHV0wIb1BBiBnPWjT+ TLSH 96C24D0873E8C572D1FE06BA883385009775D95B9913D76A6FC890AE2E237CD8A14FE4

Detection

Symbol obfuscation

Low

1 malicious · 3 files

EXEcdbde70e7dd779cebec7d5afb272da96AsyncRAT

Structure

BINResources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Config. Field	Value
Key (AES_256)	Byhuhuhuhu
Pastebin	-huhuhuhu
Install	fhuhuhuhu
Install File	Tehuhuhuhu
Install-Folder	%huhuhuhu
Version	0.huhuhuhu
Hosts	moshhuhuhuhuhuhuhu
Ports	4huhuhuhu
Mutex	Aphuhuhuhu
Delay	0huhuhuhu
Group	NYhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	AU88APP.exe
Full Name	AU88APP.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	AU88APP.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	AU88APP
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	122
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	101
Main IL	nop <null> ldc.i4.0 <null> stloc.0 <null> br.s IL_0016: ldloc.0 nop <null> ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) clt <null> stloc.1 <null> ldloc.1 <null> brtrue.s IL_0005: nop call System.Boolean Client.Settings::InitializeSettings() ldc.i4.0 <null> ceq <null> stloc.2 <null> ldloc.2 <null> brfalse.s IL_003A: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> nop <null> nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() ldc.i4.0 <null> ceq <null> stloc.3 <null> ldloc.3 <null> brfalse.s IL_004F: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_4 ldloc.s V_4 brfalse.s IL_0065: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() nop <null> ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) stloc.s V_5 ldloc.s V_5 brfalse.s IL_007B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() nop <null> ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse.s IL_008E: ldc.i4.0 call System.Boolean Client.Helper.Methods::IsAdmin() br.s IL_008F: stloc.s V_6 ldc.i4.0 <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_009B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() nop <null> call System.Void Client.Helper.Methods::PreventSleep() nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD pop <null> nop <null> nop <null> leave.s IL_00A9: br.s IL_00DD br.s IL_00DD: ldc.i4.1 nop <null> nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_00C9: nop nop <null> call System.Void Client.Connection.ClientSocket::Reconnect() nop <null> call System.Void Client.Connection.ClientSocket::InitializeClient() nop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 pop <null> nop <null> nop <null> leave.s IL_00D1: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> nop <null> ldc.i4.1 <null> stloc.s V_8 br.s IL_00AB: nop
Info	`PDB Path: C:\visualstudio\AsyncRAT-C-Sharp-master\AsyncRAT-C#\Client\obj\Debug\AU88APP.pdb`

Key (AES_256) MUTEXmalicious

Byhuhuhuhu

CnC CNCmalicious

moshhuhuhuhuhuhuhu

Ports PORTmalicious

4huhuhuhu

Mutex MUTEXmalicious

Aphuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential