asyncrat | 96f44d63a5b5b9d2aae24a25dbd94e682a2d0cfba18f3a11adc16ebab2b8760d

Sharing

Copy URL Twitter E-mail

General

Target
96f44d63a5b5b9d2aae24a25dbd94e682a2d0cfba18f3a11adc16ebab2b8760d
Size 45KB
Sample260804-w2havsxcqa
SHA256 96f44d63a5b5b9d2aae24a25dbd94e682a2d0cfba18f3a11adc16ebab2b8760d
MD5 d6e5c9be1e1f3531b0fbe290627b8520
SHA1 0757794137a5cde64e6f437a2fe2d7bc7654ebaf
SHA512 6106bbbe4b8ab201884ed977f80f6043329b742814c4b090f3d69a6d43bdb0992f52cc2af13bc05071acc9a75b1bb531abbc253edf88508341f4abcf32c15b4e
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9Yq3qvhOPIOzjbygX3ioIxwZe9qDSGyEBDZsx:EufspTf2g2GaCC3O3b1XS/flZydsx
TLSH
T140232B003BE9C12BF2BE4FB8A9F26145867AF2633503D6491CC4519B1613BC6DA126FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.top:80
zorvec.top:22
zorvec.top:8080
zorvec.top:8880
zorvec.top:2052
zorvec.top:2082
zorvec.top:2086
zorvec.top:2095
zorvec.top:443
zorvec.top:2053
zorvec.top:2083
zorvec.top:2087
zorvec.top:2096
zorvec.top:8443
www.zorvec.top:80
www.zorvec.top:22
www.zorvec.top:8080
www.zorvec.top:8880
www.zorvec.top:2052
www.zorvec.top:2082
www.zorvec.top:2086
www.zorvec.top:2095
www.zorvec.top:443
www.zorvec.top:2053
www.zorvec.top:2083
www.zorvec.top:2087
www.zorvec.top:2096
www.zorvec.top:8443
qbot.zorvec.top:80
qbot.zorvec.top:22
qbot.zorvec.top:8080
qbot.zorvec.top:8880
qbot.zorvec.top:2052
qbot.zorvec.top:2082
qbot.zorvec.top:2086
qbot.zorvec.top:2095
qbot.zorvec.top:443
qbot.zorvec.top:2053
qbot.zorvec.top:2083
qbot.zorvec.top:2087
qbot.zorvec.top:2096
qbot.zorvec.top:8443
sasser.zorvec.top:80
sasser.zorvec.top:22
sasser.zorvec.top:8080
sasser.zorvec.top:8880
sasser.zorvec.top:2052
sasser.zorvec.top:2082
sasser.zorvec.top:2086
sasser.zorvec.top:2095
sasser.zorvec.top:443
sasser.zorvec.top:2053
sasser.zorvec.top:2083
sasser.zorvec.top:2087
sasser.zorvec.top:2096
sasser.zorvec.top:8443
trisis.zorvec.top:80
trisis.zorvec.top:22
trisis.zorvec.top:8080
trisis.zorvec.top:8880
trisis.zorvec.top:2052
trisis.zorvec.top:2082
trisis.zorvec.top:2086
trisis.zorvec.top:2095
trisis.zorvec.top:443
trisis.zorvec.top:2053
trisis.zorvec.top:2083
trisis.zorvec.top:2087
trisis.zorvec.top:2096
trisis.zorvec.top:8443
cryptolocker.zorvec.top:80
cryptolocker.zorvec.top:22
cryptolocker.zorvec.top:8080
cryptolocker.zorvec.top:8880
cryptolocker.zorvec.top:2052
cryptolocker.zorvec.top:2082
cryptolocker.zorvec.top:2086
cryptolocker.zorvec.top:2095
cryptolocker.zorvec.top:443
cryptolocker.zorvec.top:2053
cryptolocker.zorvec.top:2083
cryptolocker.zorvec.top:2087
cryptolocker.zorvec.top:2096
cryptolocker.zorvec.top:8443

Mutex

TF9sNO0P0sJ6

Attributes

delay
0
install
true
install_file
tlryxeg.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  96f44d63a5b5b9d2aae24a25dbd94e682a2d0cfba18f3a11adc16ebab2b8760d
- Size 45KB
- SHA256 96f44d63a5b5b9d2aae24a25dbd94e682a2d0cfba18f3a11adc16ebab2b8760d
- MD5 d6e5c9be1e1f3531b0fbe290627b8520
- SHA1 0757794137a5cde64e6f437a2fe2d7bc7654ebaf
- SHA512 6106bbbe4b8ab201884ed977f80f6043329b742814c4b090f3d69a6d43bdb0992f52cc2af13bc05071acc9a75b1bb531abbc253edf88508341f4abcf32c15b4e
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9Yq3qvhOPIOzjbygX3ioIxwZe9qDSGyEBDZsx:EufspTf2g2GaCC3O3b1XS/flZydsx
- TLSH
  T140232B003BE9C12BF2BE4FB8A9F26145867AF2633503D6491CC4519B1613BC6DA126FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2