asyncrat | 12a0805a5faa045a140605683983dc576f6dd1420659159e019d92ff82269871

Sharing

Copy URL Twitter E-mail

General

Target
12a0805a5faa045a140605683983dc576f6dd1420659159e019d92ff82269871
Size 45KB
Sample260801-rasv3a1tav
SHA256 12a0805a5faa045a140605683983dc576f6dd1420659159e019d92ff82269871
MD5 11bcfc305f8d2cfe0c11c84c0912cd85
SHA1 4364214ed9e517e26b29a5f26431c8737469f7ec
SHA512 0e37f24205d699ea79fd87eeac1589d0a6a2a66fdcfa23d6749957d97d76afd74fbae10758b7417ca4280139c15dc94569578400897c03f54111bdfee75a779e
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVv8V1NpxkcPIyzjbjgX3iy4EE4pDMlmtUBDZEx:MuBGJTPho2s8VXvkhy3b8XSy3t2CidEx
TLSH
T1E7231A003BE8823BF2BE4F78ACF26145867EF6636603D54A1CC4519B5613FC696426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.top:80
zorvec.top:22
zorvec.top:8080
zorvec.top:8880
zorvec.top:2052
zorvec.top:2082
zorvec.top:2086
zorvec.top:2095
zorvec.top:443
zorvec.top:2053
zorvec.top:2083
zorvec.top:2087
zorvec.top:2096
zorvec.top:8443
www.zorvec.top:80
www.zorvec.top:22
www.zorvec.top:8080
www.zorvec.top:8880
www.zorvec.top:2052
www.zorvec.top:2082
www.zorvec.top:2086
www.zorvec.top:2095
www.zorvec.top:443
www.zorvec.top:2053
www.zorvec.top:2083
www.zorvec.top:2087
www.zorvec.top:2096
www.zorvec.top:8443
azorult.zorvec.top:80
azorult.zorvec.top:22
azorult.zorvec.top:8080
azorult.zorvec.top:8880
azorult.zorvec.top:2052
azorult.zorvec.top:2082
azorult.zorvec.top:2086
azorult.zorvec.top:2095
azorult.zorvec.top:443
azorult.zorvec.top:2053
azorult.zorvec.top:2083
azorult.zorvec.top:2087
azorult.zorvec.top:2096
azorult.zorvec.top:8443
clop.zorvec.top:80
clop.zorvec.top:22
clop.zorvec.top:8080
clop.zorvec.top:8880
clop.zorvec.top:2052
clop.zorvec.top:2082
clop.zorvec.top:2086
clop.zorvec.top:2095
clop.zorvec.top:443
clop.zorvec.top:2053
clop.zorvec.top:2083
clop.zorvec.top:2087
clop.zorvec.top:2096
clop.zorvec.top:8443
cryptolocker.zorvec.top:80
cryptolocker.zorvec.top:22
cryptolocker.zorvec.top:8080
cryptolocker.zorvec.top:8880
cryptolocker.zorvec.top:2052
cryptolocker.zorvec.top:2082
cryptolocker.zorvec.top:2086
cryptolocker.zorvec.top:2095
cryptolocker.zorvec.top:443
cryptolocker.zorvec.top:2053
cryptolocker.zorvec.top:2083
cryptolocker.zorvec.top:2087
cryptolocker.zorvec.top:2096
cryptolocker.zorvec.top:8443
downadup.zorvec.top:80
downadup.zorvec.top:22
downadup.zorvec.top:8080
downadup.zorvec.top:8880
downadup.zorvec.top:2052
downadup.zorvec.top:2082
downadup.zorvec.top:2086
downadup.zorvec.top:2095
downadup.zorvec.top:443
downadup.zorvec.top:2053
downadup.zorvec.top:2083
downadup.zorvec.top:2087
downadup.zorvec.top:2096
downadup.zorvec.top:8443

Mutex

QFaJab50hgL3

Attributes

delay
0
install
true
install_file
70vt.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  12a0805a5faa045a140605683983dc576f6dd1420659159e019d92ff82269871
- Size 45KB
- SHA256 12a0805a5faa045a140605683983dc576f6dd1420659159e019d92ff82269871
- MD5 11bcfc305f8d2cfe0c11c84c0912cd85
- SHA1 4364214ed9e517e26b29a5f26431c8737469f7ec
- SHA512 0e37f24205d699ea79fd87eeac1589d0a6a2a66fdcfa23d6749957d97d76afd74fbae10758b7417ca4280139c15dc94569578400897c03f54111bdfee75a779e
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVv8V1NpxkcPIyzjbjgX3iy4EE4pDMlmtUBDZEx:MuBGJTPho2s8VXvkhy3b8XSy3t2CidEx
- TLSH
  T1E7231A003BE8823BF2BE4F78ACF26145867EF6636603D54A1CC4519B5613FC696426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2