asyncrat | 6be9a2b7ee627614137e44e6a134b1f0ff38cd0372df9d0a0ecdcff1e3fca817

Sharing

Copy URL Twitter E-mail

General

Target
6be9a2b7ee627614137e44e6a134b1f0ff38cd0372df9d0a0ecdcff1e3fca817
Size 45KB
Sample260804-hrmkyaeg92
SHA256 6be9a2b7ee627614137e44e6a134b1f0ff38cd0372df9d0a0ecdcff1e3fca817
MD5 82159485e787d22cf5d926c493118e97
SHA1 10d7558061d0b8753223b3c475990c25f7b9d24c
SHA512 24713593330e3f692e2d2f0ab09ff2242451ccac6cdb323d2969022970014e9fb02ecf503fe4bf0eb867d908ce7e52c50187fe5fb17d7ba0867da134d8fe7eef
SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjkIz/yPqiPIfzjbfgX3iXzAutzI2jctr/BDZcx:DuAqJT84v2tc5f3boXS0utzRCNdcx
TLSH
T128232B003BE9C227F2BE4F749DF26145867AF6632A03D5891CC411DA5723FC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
invasive.fimsexvietnam.com:80
invasive.fimsexvietnam.com:22
invasive.fimsexvietnam.com:8080
invasive.fimsexvietnam.com:8880
invasive.fimsexvietnam.com:2052
invasive.fimsexvietnam.com:2082
invasive.fimsexvietnam.com:2086
invasive.fimsexvietnam.com:2095
invasive.fimsexvietnam.com:443
invasive.fimsexvietnam.com:2053
invasive.fimsexvietnam.com:2083
invasive.fimsexvietnam.com:2087
invasive.fimsexvietnam.com:2096
invasive.fimsexvietnam.com:8443
sasser.fimsexvietnam.com:80
sasser.fimsexvietnam.com:22
sasser.fimsexvietnam.com:8080
sasser.fimsexvietnam.com:8880
sasser.fimsexvietnam.com:2052
sasser.fimsexvietnam.com:2082
sasser.fimsexvietnam.com:2086
sasser.fimsexvietnam.com:2095
sasser.fimsexvietnam.com:443
sasser.fimsexvietnam.com:2053
sasser.fimsexvietnam.com:2083
sasser.fimsexvietnam.com:2087
sasser.fimsexvietnam.com:2096
sasser.fimsexvietnam.com:8443
shamoon.fimsexvietnam.com:80
shamoon.fimsexvietnam.com:22
shamoon.fimsexvietnam.com:8080
shamoon.fimsexvietnam.com:8880
shamoon.fimsexvietnam.com:2052
shamoon.fimsexvietnam.com:2082
shamoon.fimsexvietnam.com:2086
shamoon.fimsexvietnam.com:2095
shamoon.fimsexvietnam.com:443
shamoon.fimsexvietnam.com:2053
shamoon.fimsexvietnam.com:2083
shamoon.fimsexvietnam.com:2087
shamoon.fimsexvietnam.com:2096
shamoon.fimsexvietnam.com:8443
fakeupdates.fimsexvietnam.com:80
fakeupdates.fimsexvietnam.com:22
fakeupdates.fimsexvietnam.com:8080
fakeupdates.fimsexvietnam.com:8880
fakeupdates.fimsexvietnam.com:2052
fakeupdates.fimsexvietnam.com:2082
fakeupdates.fimsexvietnam.com:2086
fakeupdates.fimsexvietnam.com:2095
fakeupdates.fimsexvietnam.com:443
fakeupdates.fimsexvietnam.com:2053
fakeupdates.fimsexvietnam.com:2083
fakeupdates.fimsexvietnam.com:2087
fakeupdates.fimsexvietnam.com:2096
fakeupdates.fimsexvietnam.com:8443

Mutex

836wfEHVrLP7

Attributes

delay
0
install
true
install_file
e8cpse1.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6be9a2b7ee627614137e44e6a134b1f0ff38cd0372df9d0a0ecdcff1e3fca817
- Size 45KB
- SHA256 6be9a2b7ee627614137e44e6a134b1f0ff38cd0372df9d0a0ecdcff1e3fca817
- MD5 82159485e787d22cf5d926c493118e97
- SHA1 10d7558061d0b8753223b3c475990c25f7b9d24c
- SHA512 24713593330e3f692e2d2f0ab09ff2242451ccac6cdb323d2969022970014e9fb02ecf503fe4bf0eb867d908ce7e52c50187fe5fb17d7ba0867da134d8fe7eef
- SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjkIz/yPqiPIfzjbfgX3iXzAutzI2jctr/BDZcx:DuAqJT84v2tc5f3boXS0utzRCNdcx
- TLSH
  T128232B003BE9C227F2BE4F749DF26145867AF6632A03D5891CC411DA5723FC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2