asyncrat | 945f57af87bc9eeb34f4e134708efefea446bf0788a3a8efc1111bae61b96971

Sharing

Copy URL Twitter E-mail

General

Target
945f57af87bc9eeb34f4e134708efefea446bf0788a3a8efc1111bae61b96971
Size 45KB
Sample260803-h94beatwbt
SHA256 945f57af87bc9eeb34f4e134708efefea446bf0788a3a8efc1111bae61b96971
MD5 cb3162d522980b902cd93c3d057f74be
SHA1 56a52ecf70f24a42f55b0bb13844caf94be449c7
SHA512 1cc3b5b0fd94df9649311afa6c24b3dfce9ceb71f17b313a00fb5ccb3581b135b2cfec689d25eee3df8b1da3ed54161e71e5242db02da099f130c80265386fc0
SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qj8zjHy/aKPIbqjbngX3iH0f/+lpw86CAuBDZcx:DuAqJT84v2VnhbmbgXSH0f/+M1gdcx
TLSH
T1ED232B003BE9C12BF2BE4FB89DF26141467AF5632A03D58D1CC411DB5713BC68A526FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
formbook.fimsexvietnam.com:80
formbook.fimsexvietnam.com:22
formbook.fimsexvietnam.com:8080
formbook.fimsexvietnam.com:8880
formbook.fimsexvietnam.com:2052
formbook.fimsexvietnam.com:2082
formbook.fimsexvietnam.com:2086
formbook.fimsexvietnam.com:2095
formbook.fimsexvietnam.com:443
formbook.fimsexvietnam.com:2053
formbook.fimsexvietnam.com:2083
formbook.fimsexvietnam.com:2087
formbook.fimsexvietnam.com:2096
formbook.fimsexvietnam.com:8443
shamoon.fimsexvietnam.com:80
shamoon.fimsexvietnam.com:22
shamoon.fimsexvietnam.com:8080
shamoon.fimsexvietnam.com:8880
shamoon.fimsexvietnam.com:2052
shamoon.fimsexvietnam.com:2082
shamoon.fimsexvietnam.com:2086
shamoon.fimsexvietnam.com:2095
shamoon.fimsexvietnam.com:443
shamoon.fimsexvietnam.com:2053
shamoon.fimsexvietnam.com:2083
shamoon.fimsexvietnam.com:2087
shamoon.fimsexvietnam.com:2096
shamoon.fimsexvietnam.com:8443
zbot.fimsexvietnam.com:80
zbot.fimsexvietnam.com:22
zbot.fimsexvietnam.com:8080
zbot.fimsexvietnam.com:8880
zbot.fimsexvietnam.com:2052
zbot.fimsexvietnam.com:2082
zbot.fimsexvietnam.com:2086
zbot.fimsexvietnam.com:2095
zbot.fimsexvietnam.com:443
zbot.fimsexvietnam.com:2053
zbot.fimsexvietnam.com:2083
zbot.fimsexvietnam.com:2087
zbot.fimsexvietnam.com:2096
zbot.fimsexvietnam.com:8443
hermeticwiper.fimsexvietnam.com:80
hermeticwiper.fimsexvietnam.com:22
hermeticwiper.fimsexvietnam.com:8080
hermeticwiper.fimsexvietnam.com:8880
hermeticwiper.fimsexvietnam.com:2052
hermeticwiper.fimsexvietnam.com:2082
hermeticwiper.fimsexvietnam.com:2086
hermeticwiper.fimsexvietnam.com:2095
hermeticwiper.fimsexvietnam.com:443
hermeticwiper.fimsexvietnam.com:2053
hermeticwiper.fimsexvietnam.com:2083
hermeticwiper.fimsexvietnam.com:2087
hermeticwiper.fimsexvietnam.com:2096
hermeticwiper.fimsexvietnam.com:8443

Mutex

XmsM9Shfneak

Attributes

delay
0
install
true
install_file
vx94p97.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  945f57af87bc9eeb34f4e134708efefea446bf0788a3a8efc1111bae61b96971
- Size 45KB
- SHA256 945f57af87bc9eeb34f4e134708efefea446bf0788a3a8efc1111bae61b96971
- MD5 cb3162d522980b902cd93c3d057f74be
- SHA1 56a52ecf70f24a42f55b0bb13844caf94be449c7
- SHA512 1cc3b5b0fd94df9649311afa6c24b3dfce9ceb71f17b313a00fb5ccb3581b135b2cfec689d25eee3df8b1da3ed54161e71e5242db02da099f130c80265386fc0
- SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qj8zjHy/aKPIbqjbngX3iH0f/+lpw86CAuBDZcx:DuAqJT84v2VnhbmbgXSH0f/+M1gdcx
- TLSH
  T1ED232B003BE9C12BF2BE4FB89DF26141467AF5632A03D58D1CC411DB5713BC68A526FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2