asyncrat | 5aa4c165e88c0a541cfb0bcf6be523db508a931cbecb5796173df7f99e892ec6

Sharing

Copy URL Twitter E-mail

General

Target
5aa4c165e88c0a541cfb0bcf6be523db508a931cbecb5796173df7f99e892ec6
Size 45KB
Sample260803-k739qsshkb
SHA256 5aa4c165e88c0a541cfb0bcf6be523db508a931cbecb5796173df7f99e892ec6
MD5 e676d0c4477f8907db88850c317a146a
SHA1 61fd1e5c33e51c40fc10e990cab4542e2048de67
SHA512 36e62fa8e057b6071f3fa6d5bf0b927366c17ec333be833a82ba871635e7a3bf3953aabdfaf16c532eef068595186691bd1ac713dc64dd69e965dc4254c18b25
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbzCOtTMtPIDzjbNgX3iyrbte50Uh6yVQd5N6WBDZcx:Du2M5TQif2CRvD3baXSyrg6UhK5Jdcx
TLSH
T193233D003BE8812BF2BE5F7899F26145867AF5673603D58A2CC401DB5713FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
remcos.fimsexvietnam.com:80
remcos.fimsexvietnam.com:22
remcos.fimsexvietnam.com:8080
remcos.fimsexvietnam.com:8880
remcos.fimsexvietnam.com:2052
remcos.fimsexvietnam.com:2082
remcos.fimsexvietnam.com:2086
remcos.fimsexvietnam.com:2095
remcos.fimsexvietnam.com:443
remcos.fimsexvietnam.com:2053
remcos.fimsexvietnam.com:2083
remcos.fimsexvietnam.com:2087
remcos.fimsexvietnam.com:2096
remcos.fimsexvietnam.com:8443
blacklotus.fimsexvietnam.com:80
blacklotus.fimsexvietnam.com:22
blacklotus.fimsexvietnam.com:8080
blacklotus.fimsexvietnam.com:8880
blacklotus.fimsexvietnam.com:2052
blacklotus.fimsexvietnam.com:2082
blacklotus.fimsexvietnam.com:2086
blacklotus.fimsexvietnam.com:2095
blacklotus.fimsexvietnam.com:443
blacklotus.fimsexvietnam.com:2053
blacklotus.fimsexvietnam.com:2083
blacklotus.fimsexvietnam.com:2087
blacklotus.fimsexvietnam.com:2096
blacklotus.fimsexvietnam.com:8443
gozi.fimsexvietnam.com:80
gozi.fimsexvietnam.com:22
gozi.fimsexvietnam.com:8080
gozi.fimsexvietnam.com:8880
gozi.fimsexvietnam.com:2052
gozi.fimsexvietnam.com:2082
gozi.fimsexvietnam.com:2086
gozi.fimsexvietnam.com:2095
gozi.fimsexvietnam.com:443
gozi.fimsexvietnam.com:2053
gozi.fimsexvietnam.com:2083
gozi.fimsexvietnam.com:2087
gozi.fimsexvietnam.com:2096
gozi.fimsexvietnam.com:8443
cryptolocker.fimsexvietnam.com:80
cryptolocker.fimsexvietnam.com:22
cryptolocker.fimsexvietnam.com:8080
cryptolocker.fimsexvietnam.com:8880
cryptolocker.fimsexvietnam.com:2052
cryptolocker.fimsexvietnam.com:2082
cryptolocker.fimsexvietnam.com:2086
cryptolocker.fimsexvietnam.com:2095
cryptolocker.fimsexvietnam.com:443
cryptolocker.fimsexvietnam.com:2053
cryptolocker.fimsexvietnam.com:2083
cryptolocker.fimsexvietnam.com:2087
cryptolocker.fimsexvietnam.com:2096
cryptolocker.fimsexvietnam.com:8443

Mutex

U4zShGz9A1NC

Attributes

delay
0
install
true
install_file
03azy4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5aa4c165e88c0a541cfb0bcf6be523db508a931cbecb5796173df7f99e892ec6
- Size 45KB
- SHA256 5aa4c165e88c0a541cfb0bcf6be523db508a931cbecb5796173df7f99e892ec6
- MD5 e676d0c4477f8907db88850c317a146a
- SHA1 61fd1e5c33e51c40fc10e990cab4542e2048de67
- SHA512 36e62fa8e057b6071f3fa6d5bf0b927366c17ec333be833a82ba871635e7a3bf3953aabdfaf16c532eef068595186691bd1ac713dc64dd69e965dc4254c18b25
- SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbzCOtTMtPIDzjbNgX3iyrbte50Uh6yVQd5N6WBDZcx:Du2M5TQif2CRvD3baXSyrg6UhK5Jdcx
- TLSH
  T193233D003BE8812BF2BE5F7899F26145867AF5673603D58A2CC401DB5713FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2