asyncrat | bac2476fe5876b4faf994d8794432470d712fb651110a62ab27a2042501e1c11

Sharing

Copy URL Twitter E-mail

General

Target
bac2476fe5876b4faf994d8794432470d712fb651110a62ab27a2042501e1c11
Size 45KB
Sample260805-mtjpaaej2t
SHA256 bac2476fe5876b4faf994d8794432470d712fb651110a62ab27a2042501e1c11
MD5 e56dcee0b1f615d2900d7dfed63e377c
SHA1 0f79dae82d2b2a1b5ccdbe3f07f32231cf79b47c
SHA512 6d0a4caa1a3acab079c8bc5cf60c03f94e648cab8a88e98d2ce67277eca59787da4b569af9f7ac0b7ba1f92cb4978750550bfeb7ac7915b4878ed5efe7a11ca2
SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbUHO9YjoHPICYzjb8gX3il5xvhV/25tARHBDZcx:Du2M5TQif2K6kgCY3bTXSl7/Tdcx
TLSH
T1A8230B003BE9812BF2BE4FB8A9F26145867AF6633603D5491CC441DB4713FC69642AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

fimsexvietnam.com:80
fimsexvietnam.com:22
fimsexvietnam.com:8080
fimsexvietnam.com:8880
fimsexvietnam.com:2052
fimsexvietnam.com:2082
fimsexvietnam.com:2086
fimsexvietnam.com:2095
fimsexvietnam.com:443
fimsexvietnam.com:2053
fimsexvietnam.com:2083
fimsexvietnam.com:2087
fimsexvietnam.com:2096
fimsexvietnam.com:8443
www.fimsexvietnam.com:80
www.fimsexvietnam.com:22
www.fimsexvietnam.com:8080
www.fimsexvietnam.com:8880
www.fimsexvietnam.com:2052
www.fimsexvietnam.com:2082
www.fimsexvietnam.com:2086
www.fimsexvietnam.com:2095
www.fimsexvietnam.com:443
www.fimsexvietnam.com:2053
www.fimsexvietnam.com:2083
www.fimsexvietnam.com:2087
www.fimsexvietnam.com:2096
www.fimsexvietnam.com:8443
formbook.fimsexvietnam.com:80
formbook.fimsexvietnam.com:22
formbook.fimsexvietnam.com:8080
formbook.fimsexvietnam.com:8880
formbook.fimsexvietnam.com:2052
formbook.fimsexvietnam.com:2082
formbook.fimsexvietnam.com:2086
formbook.fimsexvietnam.com:2095
formbook.fimsexvietnam.com:443
formbook.fimsexvietnam.com:2053
formbook.fimsexvietnam.com:2083
formbook.fimsexvietnam.com:2087
formbook.fimsexvietnam.com:2096
formbook.fimsexvietnam.com:8443
gh0st.fimsexvietnam.com:80
gh0st.fimsexvietnam.com:22
gh0st.fimsexvietnam.com:8080
gh0st.fimsexvietnam.com:8880
gh0st.fimsexvietnam.com:2052
gh0st.fimsexvietnam.com:2082
gh0st.fimsexvietnam.com:2086
gh0st.fimsexvietnam.com:2095
gh0st.fimsexvietnam.com:443
gh0st.fimsexvietnam.com:2053
gh0st.fimsexvietnam.com:2083
gh0st.fimsexvietnam.com:2087
gh0st.fimsexvietnam.com:2096
gh0st.fimsexvietnam.com:8443
malware.fimsexvietnam.com:80
malware.fimsexvietnam.com:22
malware.fimsexvietnam.com:8080
malware.fimsexvietnam.com:8880
malware.fimsexvietnam.com:2052
malware.fimsexvietnam.com:2082
malware.fimsexvietnam.com:2086
malware.fimsexvietnam.com:2095
malware.fimsexvietnam.com:443
malware.fimsexvietnam.com:2053
malware.fimsexvietnam.com:2083
malware.fimsexvietnam.com:2087
malware.fimsexvietnam.com:2096
malware.fimsexvietnam.com:8443
hermeticwiper.fimsexvietnam.com:80
hermeticwiper.fimsexvietnam.com:22
hermeticwiper.fimsexvietnam.com:8080
hermeticwiper.fimsexvietnam.com:8880
hermeticwiper.fimsexvietnam.com:2052
hermeticwiper.fimsexvietnam.com:2082
hermeticwiper.fimsexvietnam.com:2086
hermeticwiper.fimsexvietnam.com:2095
hermeticwiper.fimsexvietnam.com:443
hermeticwiper.fimsexvietnam.com:2053
hermeticwiper.fimsexvietnam.com:2083
hermeticwiper.fimsexvietnam.com:2087
hermeticwiper.fimsexvietnam.com:2096
hermeticwiper.fimsexvietnam.com:8443

Mutex

paaF378156EC

Attributes

delay
0
install
true
install_file
xjvvtz.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  bac2476fe5876b4faf994d8794432470d712fb651110a62ab27a2042501e1c11
- Size 45KB
- SHA256 bac2476fe5876b4faf994d8794432470d712fb651110a62ab27a2042501e1c11
- MD5 e56dcee0b1f615d2900d7dfed63e377c
- SHA1 0f79dae82d2b2a1b5ccdbe3f07f32231cf79b47c
- SHA512 6d0a4caa1a3acab079c8bc5cf60c03f94e648cab8a88e98d2ce67277eca59787da4b569af9f7ac0b7ba1f92cb4978750550bfeb7ac7915b4878ed5efe7a11ca2
- SSDEEP 768:Du2M5TQEdz5WU95dPmo2qbUHO9YjoHPICYzjb8gX3il5xvhV/25tARHBDZcx:Du2M5TQif2K6kgCY3bTXSl7/Tdcx
- TLSH
  T1A8230B003BE9812BF2BE4FB8A9F26145867AF6633603D5491CC441DB4713FC69642AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2