asyncrat | 5ff1606cf0d18c9488573faa874bdd7be67703debcc0fc05f2b47f09d2c6d269

Sharing

Copy URL Twitter E-mail

General

Target
5ff1606cf0d18c9488573faa874bdd7be67703debcc0fc05f2b47f09d2c6d269
Size 45KB
Sample260710-rna76sdt3t
SHA256 5ff1606cf0d18c9488573faa874bdd7be67703debcc0fc05f2b47f09d2c6d269
MD5 cda1ecd4ebecb7f7e094e414d1cc786b
SHA1 8687826be9047d87f356324a726365ea5bea0801
SHA512 06968ce1f29b01a0220c10e85be46916c125805e3909ee6468df8f623e0a7432cfe69a734b5119964a848dd6cb24d9e050240eebe55e5914ecf232dc16b21f8e
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFG9xY6aZOOPIrzjbVgO3i3YukLYzOwHBDZEx:MuLAZTnbg2Ds/O3r3byOSB3qwhdEx
TLSH
T1B3233B003BE98127F2BE4FB8A9F26145467AF6772603D68D1CC451DB4613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsec.com:80
fimsec.com:22
fimsec.com:8080
fimsec.com:8880
fimsec.com:2052
fimsec.com:2082
fimsec.com:2086
fimsec.com:2095
fimsec.com:443
fimsec.com:2053
fimsec.com:2083
fimsec.com:2087
fimsec.com:2096
fimsec.com:8443
www.fimsec.com:80
www.fimsec.com:22
www.fimsec.com:8080
www.fimsec.com:8880
www.fimsec.com:2052
www.fimsec.com:2082
www.fimsec.com:2086
www.fimsec.com:2095
www.fimsec.com:443
www.fimsec.com:2053
www.fimsec.com:2083
www.fimsec.com:2087
www.fimsec.com:2096
www.fimsec.com:8443
connect.fimsec.com:80
connect.fimsec.com:22
connect.fimsec.com:8080
connect.fimsec.com:8880
connect.fimsec.com:2052
connect.fimsec.com:2082
connect.fimsec.com:2086
connect.fimsec.com:2095
connect.fimsec.com:443
connect.fimsec.com:2053
connect.fimsec.com:2083
connect.fimsec.com:2087
connect.fimsec.com:2096
connect.fimsec.com:8443
darkside.fimsec.com:80
darkside.fimsec.com:22
darkside.fimsec.com:8080
darkside.fimsec.com:8880
darkside.fimsec.com:2052
darkside.fimsec.com:2082
darkside.fimsec.com:2086
darkside.fimsec.com:2095
darkside.fimsec.com:443
darkside.fimsec.com:2053
darkside.fimsec.com:2083
darkside.fimsec.com:2087
darkside.fimsec.com:2096
darkside.fimsec.com:8443
hermeticwiper.fimsec.com:80
hermeticwiper.fimsec.com:22
hermeticwiper.fimsec.com:8080
hermeticwiper.fimsec.com:8880
hermeticwiper.fimsec.com:2052
hermeticwiper.fimsec.com:2082
hermeticwiper.fimsec.com:2086
hermeticwiper.fimsec.com:2095
hermeticwiper.fimsec.com:443
hermeticwiper.fimsec.com:2053
hermeticwiper.fimsec.com:2083
hermeticwiper.fimsec.com:2087
hermeticwiper.fimsec.com:2096
hermeticwiper.fimsec.com:8443
codered.fimsec.com:80
codered.fimsec.com:22
codered.fimsec.com:8080
codered.fimsec.com:8880
codered.fimsec.com:2052
codered.fimsec.com:2082
codered.fimsec.com:2086
codered.fimsec.com:2095
codered.fimsec.com:443
codered.fimsec.com:2053
codered.fimsec.com:2083
codered.fimsec.com:2087
codered.fimsec.com:2096
codered.fimsec.com:8443

Mutex

wf6ELSjzNuVx

Attributes

delay
0
install
true
install_file
74xqi.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5ff1606cf0d18c9488573faa874bdd7be67703debcc0fc05f2b47f09d2c6d269
- Size 45KB
- SHA256 5ff1606cf0d18c9488573faa874bdd7be67703debcc0fc05f2b47f09d2c6d269
- MD5 cda1ecd4ebecb7f7e094e414d1cc786b
- SHA1 8687826be9047d87f356324a726365ea5bea0801
- SHA512 06968ce1f29b01a0220c10e85be46916c125805e3909ee6468df8f623e0a7432cfe69a734b5119964a848dd6cb24d9e050240eebe55e5914ecf232dc16b21f8e
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFG9xY6aZOOPIrzjbVgO3i3YukLYzOwHBDZEx:MuLAZTnbg2Ds/O3r3byOSB3qwhdEx
- TLSH
  T1B3233B003BE98127F2BE4FB8A9F26145467AF6772603D68D1CC451DB4613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2