asyncrat | 5d0259adf99b3921edbf976299dd4e59f0ccbec63d8e0731a542eb0cd46e3e13

Sharing

Copy URL Twitter E-mail

General

Target
5d0259adf99b3921edbf976299dd4e59f0ccbec63d8e0731a542eb0cd46e3e13
Size 45KB
Sample260815-sd558syzez
SHA256 5d0259adf99b3921edbf976299dd4e59f0ccbec63d8e0731a542eb0cd46e3e13
MD5 ad5fd4b320f269df64a26d6614e34c51
SHA1 74b6b6962fb4d803566fc541fe6c4c20a6e6b52f
SHA512 22f36e59d16e042a020e9e7822445f0ce4bf943dce9f4e1929f43727c08e759c9e2ac8bd52965963bf09f9f7848b871a57c9f297850e0ac5b6a25c1a1aff1800
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9b9YikqHztOPIUzjbMgb3i/5Xsl5AcQn4sBDZsx:EufspTf2g2WalK3U3bDbSzTn4qdsx
TLSH
T1A92329003BE9C12BF2BE4F78ADF26145867AF1633603D64A1CC4529B5613FC68A426FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
klez.zorvec.name:80
klez.zorvec.name:22
klez.zorvec.name:8080
klez.zorvec.name:8880
klez.zorvec.name:2052
klez.zorvec.name:2082
klez.zorvec.name:2086
klez.zorvec.name:2095
klez.zorvec.name:443
klez.zorvec.name:2053
klez.zorvec.name:2083
klez.zorvec.name:2087
klez.zorvec.name:2096
klez.zorvec.name:8443
conti.zorvec.name:80
conti.zorvec.name:22
conti.zorvec.name:8080
conti.zorvec.name:8880
conti.zorvec.name:2052
conti.zorvec.name:2082
conti.zorvec.name:2086
conti.zorvec.name:2095
conti.zorvec.name:443
conti.zorvec.name:2053
conti.zorvec.name:2083
conti.zorvec.name:2087
conti.zorvec.name:2096
conti.zorvec.name:8443
sobig.zorvec.name:80
sobig.zorvec.name:22
sobig.zorvec.name:8080
sobig.zorvec.name:8880
sobig.zorvec.name:2052
sobig.zorvec.name:2082
sobig.zorvec.name:2086
sobig.zorvec.name:2095
sobig.zorvec.name:443
sobig.zorvec.name:2053
sobig.zorvec.name:2083
sobig.zorvec.name:2087
sobig.zorvec.name:2096
sobig.zorvec.name:8443
invasive.zorvec.name:80
invasive.zorvec.name:22
invasive.zorvec.name:8080
invasive.zorvec.name:8880
invasive.zorvec.name:2052
invasive.zorvec.name:2082
invasive.zorvec.name:2086
invasive.zorvec.name:2095
invasive.zorvec.name:443
invasive.zorvec.name:2053
invasive.zorvec.name:2083
invasive.zorvec.name:2087
invasive.zorvec.name:2096
invasive.zorvec.name:8443

Mutex

RCjoeHy2PD9f

Attributes

delay
0
install
true
install_file
c07rd6h.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  5d0259adf99b3921edbf976299dd4e59f0ccbec63d8e0731a542eb0cd46e3e13
- Size 45KB
- SHA256 5d0259adf99b3921edbf976299dd4e59f0ccbec63d8e0731a542eb0cd46e3e13
- MD5 ad5fd4b320f269df64a26d6614e34c51
- SHA1 74b6b6962fb4d803566fc541fe6c4c20a6e6b52f
- SHA512 22f36e59d16e042a020e9e7822445f0ce4bf943dce9f4e1929f43727c08e759c9e2ac8bd52965963bf09f9f7848b871a57c9f297850e0ac5b6a25c1a1aff1800
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9b9YikqHztOPIUzjbMgb3i/5Xsl5AcQn4sBDZsx:EufspTf2g2WalK3U3bDbSzTn4qdsx
- TLSH
  T1A92329003BE9C12BF2BE4F78ADF26145867AF1633603D64A1CC4529B5613FC68A426FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2