Identifier / Programs / Windows
rasautou.exe
Remote Access Dialer file version info (xCyclopedia)
LOLBAS Execute 1 Sigma rule name it 1 ATT&CK technique 1 documented command 14 known copies with hashes
How rasautou.exe is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for rasautou.exe.
1 documented command
Execute T1218 System Binary Proxy Execution User, Administrator in Windows 8 privileges
Loads the target .DLL specified in -d and executes the export specified in -p. Options removed in Windows 10.
rasautou -d {PATH:.dll} -p export_name -a a -e eTrips 1 Sigma rule: mediumDLL Execution via Rasautou.exe by Julia Fomina, oscd.community
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for rasautou.exe, by Tony Lambert, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for rasautou.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real rasautou.exe?
rasdlui.exe in the file’s header: a renamed copy still carries itC:\Windows\system32\C:\Windows\SysWOW64\14 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rasautou.exe · signed by Microsoft Windows
11c4a4c4196dcd94b6d68763b90f655a4873e02b028ab1a616a8c34222332cdd10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rasautou.exe · signed by Microsoft Windows
7dc7a64168f741932a45fad98009cea05a4b26d5d2c92165d78a372c7e8713ab10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasautou.exe · signed by Microsoft Windows
51b2f4f5b5cfb55143113b3071bb62fecd4015baab59315cfff5ea8be4a4b3b410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rasautou.exe · signed by Microsoft Windows
3784bc31bf8a72d3d8af7726f6944b7c8c17ac6d797654830f462a4a3a33a01310.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasautou.exe · signed by Microsoft Windows
8ec4aa31453bfc331ba80246e8af378dba1db27ddf1f9483a919fa89bffd262610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rasautou.exe · signed by Microsoft Windows
eec5dbdf411a89f65247679840dc7a902180c1d23c94b0d92c283b413066426310.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rasautou.exe · signed by Microsoft Windows
2ca3d32921b11c5307dca89834c7f1d27894fe498298eefb5c2281448a14f78310.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rasautou.exe · signed by Microsoft Windows
a806af080dc55499462c55c93e7eb701b01e71079de9ed0e5f439c1257f2725d10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasautou.exe · signed by Microsoft Windows
f5fe16960331d2cb819706baa6e1935097cc09a843a4747ffbcd3c8e27ed1cd510.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rasautou.exe · signed by Microsoft Windows
f9a9db182517c828fc9e23ea1fdc9902c07bad260dd4fd34086446bd9c109b7010.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rasautou.exe · signed by Microsoft Windows
049a173c36f34089b4d427fa10ae3875b6ab49577c891565c2c5e5ee5c6efd4710.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rasautou.exe · signed by Microsoft Windows
2e8d13d56fb667876ce3351dbef145850c710698edd9f9fbd9cda87b62730cb06.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rasautou.exe · not signed
165487d878513cfc082fe37100e52188938ec93675ff3b44f4712333c3c558c86.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rasautou.exe · not signed
971ef57fe7a61f62cbe81857525206bf03e59df1377a6c6de700dc7856fcc089From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.