asyncrat | 158de39595249c2ded84051dc3390f107d9d92aa396bf155531bf3f40d4027ef

Sharing

Copy URL Twitter E-mail

General

Target
158de39595249c2ded84051dc3390f107d9d92aa396bf155531bf3f40d4027ef
Size 45KB
Sample260803-vg6x2sce35
SHA256 158de39595249c2ded84051dc3390f107d9d92aa396bf155531bf3f40d4027ef
MD5 c80889bc362ea1c2173d153b12e03d73
SHA1 6788b634d5418d28cafb6133955260bf44dd1f55
SHA512 3499f9fe49d417a62c7a35ec81687a7d0c4896f1e16516b0ea9b7ca7bd1d3513fe7fb9e119706f2c04dd650d8dd4af9281f1e790431098849164103dfa0e62ff
SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qrmGsGx8OHuPI2zjb6gv3i7UHfCIlVwsZCK/pBDZkx:7uCIJTQmX2Zez323btvS7MKIlVwscc3k
TLSH
T14D233B003BE9812BF2BE4FB899F26145867AF5732603E5492CC441D75623BC6DA426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
stuxnet.fimsexvietnam.com:80
stuxnet.fimsexvietnam.com:22
stuxnet.fimsexvietnam.com:8080
stuxnet.fimsexvietnam.com:8880
stuxnet.fimsexvietnam.com:2052
stuxnet.fimsexvietnam.com:2082
stuxnet.fimsexvietnam.com:2086
stuxnet.fimsexvietnam.com:2095
stuxnet.fimsexvietnam.com:443
stuxnet.fimsexvietnam.com:2053
stuxnet.fimsexvietnam.com:2083
stuxnet.fimsexvietnam.com:2087
stuxnet.fimsexvietnam.com:2096
stuxnet.fimsexvietnam.com:8443
fakeupdates.fimsexvietnam.com:80
fakeupdates.fimsexvietnam.com:22
fakeupdates.fimsexvietnam.com:8080
fakeupdates.fimsexvietnam.com:8880
fakeupdates.fimsexvietnam.com:2052
fakeupdates.fimsexvietnam.com:2082
fakeupdates.fimsexvietnam.com:2086
fakeupdates.fimsexvietnam.com:2095
fakeupdates.fimsexvietnam.com:443
fakeupdates.fimsexvietnam.com:2053
fakeupdates.fimsexvietnam.com:2083
fakeupdates.fimsexvietnam.com:2087
fakeupdates.fimsexvietnam.com:2096
fakeupdates.fimsexvietnam.com:8443
gh0st.fimsexvietnam.com:80
gh0st.fimsexvietnam.com:22
gh0st.fimsexvietnam.com:8080
gh0st.fimsexvietnam.com:8880
gh0st.fimsexvietnam.com:2052
gh0st.fimsexvietnam.com:2082
gh0st.fimsexvietnam.com:2086
gh0st.fimsexvietnam.com:2095
gh0st.fimsexvietnam.com:443
gh0st.fimsexvietnam.com:2053
gh0st.fimsexvietnam.com:2083
gh0st.fimsexvietnam.com:2087
gh0st.fimsexvietnam.com:2096
gh0st.fimsexvietnam.com:8443
trickbot.fimsexvietnam.com:80
trickbot.fimsexvietnam.com:22
trickbot.fimsexvietnam.com:8080
trickbot.fimsexvietnam.com:8880
trickbot.fimsexvietnam.com:2052
trickbot.fimsexvietnam.com:2082
trickbot.fimsexvietnam.com:2086
trickbot.fimsexvietnam.com:2095
trickbot.fimsexvietnam.com:443
trickbot.fimsexvietnam.com:2053
trickbot.fimsexvietnam.com:2083
trickbot.fimsexvietnam.com:2087
trickbot.fimsexvietnam.com:2096
trickbot.fimsexvietnam.com:8443

Mutex

iJ79TOSx7JgL

Attributes

delay
0
install
true
install_file
xt6pabzg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  158de39595249c2ded84051dc3390f107d9d92aa396bf155531bf3f40d4027ef
- Size 45KB
- SHA256 158de39595249c2ded84051dc3390f107d9d92aa396bf155531bf3f40d4027ef
- MD5 c80889bc362ea1c2173d153b12e03d73
- SHA1 6788b634d5418d28cafb6133955260bf44dd1f55
- SHA512 3499f9fe49d417a62c7a35ec81687a7d0c4896f1e16516b0ea9b7ca7bd1d3513fe7fb9e119706f2c04dd650d8dd4af9281f1e790431098849164103dfa0e62ff
- SSDEEP 768:7uCIJTQc5fVWUhxlDmo2qrmGsGx8OHuPI2zjb6gv3i7UHfCIlVwsZCK/pBDZkx:7uCIJTQmX2Zez323btvS7MKIlVwscc3k
- TLSH
  T14D233B003BE9812BF2BE4FB899F26145867AF5732603E5492CC441D75623BC6DA426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2