asyncrat | 7fb7c73b28033472242c35220f406ce5d9f6578090970c83642bcf5be73f7555

Sharing

Copy URL Twitter E-mail

General

Target
7fb7c73b28033472242c35220f406ce5d9f6578090970c83642bcf5be73f7555
Size 45KB
Sample260801-wxwyfstbmd
SHA256 7fb7c73b28033472242c35220f406ce5d9f6578090970c83642bcf5be73f7555
MD5 1c2523459a8a7996ac02e9a24dfa5484
SHA1 e2e2c996bfdf4902f7afa9dc816ce558f4db4b9f
SHA512 84ee727f60df719ccf5dfd2d7b6685ac3a72f9282f9e76041955788cdf3bef111ab152e816c80ee4bd7bd929b03f0c158e0904b4a707cd6ba7321a69f6b03a88
SSDEEP 768:EulCJTHESwgWUK3aGmo2q95oRQKIJOPIhzjbNgM3i1WqzrawkE3kzeFQVo96BBDI:EulCJTHl42mYxg3h3baMS1Wouwl64gdu
TLSH
T120232A003BE8823BF2BE4F7898F26145867AF6637603D54A1CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.top:80
zorvec.top:22
zorvec.top:8080
zorvec.top:8880
zorvec.top:2052
zorvec.top:2082
zorvec.top:2086
zorvec.top:2095
zorvec.top:443
zorvec.top:2053
zorvec.top:2083
zorvec.top:2087
zorvec.top:2096
zorvec.top:8443
www.zorvec.top:80
www.zorvec.top:22
www.zorvec.top:8080
www.zorvec.top:8880
www.zorvec.top:2052
www.zorvec.top:2082
www.zorvec.top:2086
www.zorvec.top:2095
www.zorvec.top:443
www.zorvec.top:2053
www.zorvec.top:2083
www.zorvec.top:2087
www.zorvec.top:2096
www.zorvec.top:8443
cryptolocker.zorvec.top:80
cryptolocker.zorvec.top:22
cryptolocker.zorvec.top:8080
cryptolocker.zorvec.top:8880
cryptolocker.zorvec.top:2052
cryptolocker.zorvec.top:2082
cryptolocker.zorvec.top:2086
cryptolocker.zorvec.top:2095
cryptolocker.zorvec.top:443
cryptolocker.zorvec.top:2053
cryptolocker.zorvec.top:2083
cryptolocker.zorvec.top:2087
cryptolocker.zorvec.top:2096
cryptolocker.zorvec.top:8443
darkside.zorvec.top:80
darkside.zorvec.top:22
darkside.zorvec.top:8080
darkside.zorvec.top:8880
darkside.zorvec.top:2052
darkside.zorvec.top:2082
darkside.zorvec.top:2086
darkside.zorvec.top:2095
darkside.zorvec.top:443
darkside.zorvec.top:2053
darkside.zorvec.top:2083
darkside.zorvec.top:2087
darkside.zorvec.top:2096
darkside.zorvec.top:8443
melissa.zorvec.top:80
melissa.zorvec.top:22
melissa.zorvec.top:8080
melissa.zorvec.top:8880
melissa.zorvec.top:2052
melissa.zorvec.top:2082
melissa.zorvec.top:2086
melissa.zorvec.top:2095
melissa.zorvec.top:443
melissa.zorvec.top:2053
melissa.zorvec.top:2083
melissa.zorvec.top:2087
melissa.zorvec.top:2096
melissa.zorvec.top:8443
nanocore.zorvec.top:80
nanocore.zorvec.top:22
nanocore.zorvec.top:8080
nanocore.zorvec.top:8880
nanocore.zorvec.top:2052
nanocore.zorvec.top:2082
nanocore.zorvec.top:2086
nanocore.zorvec.top:2095
nanocore.zorvec.top:443
nanocore.zorvec.top:2053
nanocore.zorvec.top:2083
nanocore.zorvec.top:2087
nanocore.zorvec.top:2096
nanocore.zorvec.top:8443

Mutex

TJGX2GjgnfX8

Attributes

delay
0
install
true
install_file
ltsqvg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7fb7c73b28033472242c35220f406ce5d9f6578090970c83642bcf5be73f7555
- Size 45KB
- SHA256 7fb7c73b28033472242c35220f406ce5d9f6578090970c83642bcf5be73f7555
- MD5 1c2523459a8a7996ac02e9a24dfa5484
- SHA1 e2e2c996bfdf4902f7afa9dc816ce558f4db4b9f
- SHA512 84ee727f60df719ccf5dfd2d7b6685ac3a72f9282f9e76041955788cdf3bef111ab152e816c80ee4bd7bd929b03f0c158e0904b4a707cd6ba7321a69f6b03a88
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q95oRQKIJOPIhzjbNgM3i1WqzrawkE3kzeFQVo96BBDI:EulCJTHl42mYxg3h3baMS1Wouwl64gdu
- TLSH
  T120232A003BE8823BF2BE4F7898F26145867AF6637603D54A1CC451DB5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2