asyncrat | ec91c011586bbbc7153b4b034b159abd13a7461aa650d55163eea80b21128d88

Sharing

Copy URL Twitter E-mail

General

Target
ec91c011586bbbc7153b4b034b159abd13a7461aa650d55163eea80b21128d88
Size 45KB
Sample260803-tsahjsshme
SHA256 ec91c011586bbbc7153b4b034b159abd13a7461aa650d55163eea80b21128d88
MD5 d7dd9e65e30b255a4330feb66b50adef
SHA1 019f6c71285f2c13e97098cae62a27e1cf555bb6
SHA512 d66c211892c47617ae9f3db0f4e7d096197ca1523e3638281ff742fd43c2ccdde818dbe717fd5ea8057243f4da21d79c68e4f9d76587fcd678c7b3b341f93e1a
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbtCSwTMjPIuYjbfgX3igtIvXxHCPtBDZcx:Du2M5TQif24g1uQboXSUmhHCjdcx
TLSH
T14F232B003BE8C12BF2BE4F7899F26245867AF2633603D6491CC451DB5723FC69A426F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
shamoon.fimsexvietnam.com:80
shamoon.fimsexvietnam.com:22
shamoon.fimsexvietnam.com:8080
shamoon.fimsexvietnam.com:8880
shamoon.fimsexvietnam.com:2052
shamoon.fimsexvietnam.com:2082
shamoon.fimsexvietnam.com:2086
shamoon.fimsexvietnam.com:2095
shamoon.fimsexvietnam.com:443
shamoon.fimsexvietnam.com:2053
shamoon.fimsexvietnam.com:2083
shamoon.fimsexvietnam.com:2087
shamoon.fimsexvietnam.com:2096
shamoon.fimsexvietnam.com:8443
darkside.fimsexvietnam.com:80
darkside.fimsexvietnam.com:22
darkside.fimsexvietnam.com:8080
darkside.fimsexvietnam.com:8880
darkside.fimsexvietnam.com:2052
darkside.fimsexvietnam.com:2082
darkside.fimsexvietnam.com:2086
darkside.fimsexvietnam.com:2095
darkside.fimsexvietnam.com:443
darkside.fimsexvietnam.com:2053
darkside.fimsexvietnam.com:2083
darkside.fimsexvietnam.com:2087
darkside.fimsexvietnam.com:2096
darkside.fimsexvietnam.com:8443
industroyer.fimsexvietnam.com:80
industroyer.fimsexvietnam.com:22
industroyer.fimsexvietnam.com:8080
industroyer.fimsexvietnam.com:8880
industroyer.fimsexvietnam.com:2052
industroyer.fimsexvietnam.com:2082
industroyer.fimsexvietnam.com:2086
industroyer.fimsexvietnam.com:2095
industroyer.fimsexvietnam.com:443
industroyer.fimsexvietnam.com:2053
industroyer.fimsexvietnam.com:2083
industroyer.fimsexvietnam.com:2087
industroyer.fimsexvietnam.com:2096
industroyer.fimsexvietnam.com:8443
conficker.fimsexvietnam.com:80
conficker.fimsexvietnam.com:22
conficker.fimsexvietnam.com:8080
conficker.fimsexvietnam.com:8880
conficker.fimsexvietnam.com:2052
conficker.fimsexvietnam.com:2082
conficker.fimsexvietnam.com:2086
conficker.fimsexvietnam.com:2095
conficker.fimsexvietnam.com:443
conficker.fimsexvietnam.com:2053
conficker.fimsexvietnam.com:2083
conficker.fimsexvietnam.com:2087
conficker.fimsexvietnam.com:2096
conficker.fimsexvietnam.com:8443

Mutex

g32CwKqn4Imd

Attributes

delay
0
install
true
install_file
g2pkw6.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  ec91c011586bbbc7153b4b034b159abd13a7461aa650d55163eea80b21128d88
- Size 45KB
- SHA256 ec91c011586bbbc7153b4b034b159abd13a7461aa650d55163eea80b21128d88
- MD5 d7dd9e65e30b255a4330feb66b50adef
- SHA1 019f6c71285f2c13e97098cae62a27e1cf555bb6
- SHA512 d66c211892c47617ae9f3db0f4e7d096197ca1523e3638281ff742fd43c2ccdde818dbe717fd5ea8057243f4da21d79c68e4f9d76587fcd678c7b3b341f93e1a
- SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbtCSwTMjPIuYjbfgX3igtIvXxHCPtBDZcx:Du2M5TQif24g1uQboXSUmhHCjdcx
- TLSH
  T14F232B003BE8C12BF2BE4F7899F26245867AF2633603D6491CC451DB5723FC69A426F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2