asyncrat | 796d5d00818d2166d80cb48db684c39598774e88bb656914cc818cb69fe9cdae

Resubmissions

20/07/2026, 09:24

260720-lc9zgafx3v10

20/07/2026, 09:15

260720-k8d18scx9m10

Sharing

Copy URL Twitter E-mail

General

Target
796d5d00818d2166d80cb48db684c39598774e88bb656914cc818cb69fe9cdae
Size 45KB
Sample260720-k8d18scx9m
SHA256 796d5d00818d2166d80cb48db684c39598774e88bb656914cc818cb69fe9cdae
MD5 146537c81f2004019aba07d5d13e7b78
SHA1 cb3560e32d7b8a18fbff7ef08a5c8c338a0671ad
SHA512 782da9038f857206680f1c2f1ba1bdfcd55abc8c50b7144db30c8f8939cb5b63e94da59f7b90994d260518921b61c9d7e82eaaa49fd1461498eb43c58122fa66
SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZo3TMtPImYjbHgX3iwffOSzne6j5M7TBDZ0x:8uuSpTgyf2tU3mQbAXSAfOenfM71d0x
TLSH
T1EF232B0037E8812BF2BE4F7898F26245867AF5673603D54A2CC451DB5B13FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

shokbazar.com:80
shokbazar.com:22
shokbazar.com:8080
shokbazar.com:8880
shokbazar.com:2052
shokbazar.com:2082
shokbazar.com:2086
shokbazar.com:2095
shokbazar.com:443
shokbazar.com:2053
shokbazar.com:2083
shokbazar.com:2087
shokbazar.com:2096
shokbazar.com:8443
www.shokbazar.com:80
www.shokbazar.com:22
www.shokbazar.com:8080
www.shokbazar.com:8880
www.shokbazar.com:2052
www.shokbazar.com:2082
www.shokbazar.com:2086
www.shokbazar.com:2095
www.shokbazar.com:443
www.shokbazar.com:2053
www.shokbazar.com:2083
www.shokbazar.com:2087
www.shokbazar.com:2096
www.shokbazar.com:8443
rat.shokbazar.com:80
rat.shokbazar.com:22
rat.shokbazar.com:8080
rat.shokbazar.com:8880
rat.shokbazar.com:2052
rat.shokbazar.com:2082
rat.shokbazar.com:2086
rat.shokbazar.com:2095
rat.shokbazar.com:443
rat.shokbazar.com:2053
rat.shokbazar.com:2083
rat.shokbazar.com:2087
rat.shokbazar.com:2096
rat.shokbazar.com:8443
mydoom.shokbazar.com:80
mydoom.shokbazar.com:22
mydoom.shokbazar.com:8080
mydoom.shokbazar.com:8880
mydoom.shokbazar.com:2052
mydoom.shokbazar.com:2082
mydoom.shokbazar.com:2086
mydoom.shokbazar.com:2095
mydoom.shokbazar.com:443
mydoom.shokbazar.com:2053
mydoom.shokbazar.com:2083
mydoom.shokbazar.com:2087
mydoom.shokbazar.com:2096
mydoom.shokbazar.com:8443
nanocore.shokbazar.com:80
nanocore.shokbazar.com:22
nanocore.shokbazar.com:8080
nanocore.shokbazar.com:8880
nanocore.shokbazar.com:2052
nanocore.shokbazar.com:2082
nanocore.shokbazar.com:2086
nanocore.shokbazar.com:2095
nanocore.shokbazar.com:443
nanocore.shokbazar.com:2053
nanocore.shokbazar.com:2083
nanocore.shokbazar.com:2087
nanocore.shokbazar.com:2096
nanocore.shokbazar.com:8443
azorult.shokbazar.com:80
azorult.shokbazar.com:22
azorult.shokbazar.com:8080
azorult.shokbazar.com:8880
azorult.shokbazar.com:2052
azorult.shokbazar.com:2082
azorult.shokbazar.com:2086
azorult.shokbazar.com:2095
azorult.shokbazar.com:443
azorult.shokbazar.com:2053
azorult.shokbazar.com:2083
azorult.shokbazar.com:2087
azorult.shokbazar.com:2096
azorult.shokbazar.com:8443

Mutex

80xMWg28e7Cb

Attributes

delay
0
install
true
install_file
a105nb.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  796d5d00818d2166d80cb48db684c39598774e88bb656914cc818cb69fe9cdae
- Size 45KB
- SHA256 796d5d00818d2166d80cb48db684c39598774e88bb656914cc818cb69fe9cdae
- MD5 146537c81f2004019aba07d5d13e7b78
- SHA1 cb3560e32d7b8a18fbff7ef08a5c8c338a0671ad
- SHA512 782da9038f857206680f1c2f1ba1bdfcd55abc8c50b7144db30c8f8939cb5b63e94da59f7b90994d260518921b61c9d7e82eaaa49fd1461498eb43c58122fa66
- SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZo3TMtPImYjbHgX3iwffOSzne6j5M7TBDZ0x:8uuSpTgyf2tU3mQbAXSAfOenfM71d0x
- TLSH
  T1EF232B0037E8812BF2BE4F7898F26245867AF5673603D54A2CC451DB5B13FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2