Overview

overview

10

Static

static

10

ForgeMaste...up.exe

windows10-2004-x64

10

ForgeMaste...up.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ForgeMaster_Industrial_MES_2026_Enterprise_Edition_setup.bin
  • Size 65KB
  • Sample260623-qemdeac12k
  • SHA256 48ae658e6808b29c5237fe73be4509a3cc0a5411cc80465149ec5e2ec824e359
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratchrome_exedefense_evasionexecutionpersistencerat

Malware Config

Extracted

Family

  • asyncrat

Botnet

  • chrome_exe

C2

  • riski.my:2048

  • riski.my:4782

  • riski.my:443

  • riski.my:8888

  • riski.my:8848

  • epic1688.com:2048

  • epic1688.com:4782

  • epic1688.com:443

  • epic1688.com:8888

  • epic1688.com:8848

  • vsc888.bond:2048

  • vsc888.bond:4782

  • vsc888.bond:443

  • vsc888.bond:8888

  • vsc888.bond:8848

  • isc888bkk.com:2048

  • isc888bkk.com:4782

  • isc888bkk.com:443

  • isc888bkk.com:8888

  • isc888bkk.com:8848

Mutex

  • chrome_exe

Attributes
  • delay

    1

  • install

    true

  • install_file

    ForgeMaster_Industrial_MES_2026_Enterprise_Edition_setup.bin.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      ForgeMaster_Industrial_MES_2026_Enterprise_Edition_setup.bin
    • Size 65KB
    • SHA256 48ae658e6808b29c5237fe73be4509a3cc0a5411cc80465149ec5e2ec824e359
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    chrome_exedefense_evasionexecutionasyncratpersistencerat

    • Async RAT payload

      rat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks