asyncrat | bf32250d1eedcbb7f7e9e792844098ce9592742fa845e29be3defe8466d3fb9e

Sharing

Copy URL Twitter E-mail

General

Target
bf32250d1eedcbb7f7e9e792844098ce9592742fa845e29be3defe8466d3fb9e
Size 45KB
Sample260816-ld6cnsvapc
SHA256 bf32250d1eedcbb7f7e9e792844098ce9592742fa845e29be3defe8466d3fb9e
MD5 33a5bd83d5eedfe61a1a2d85675f8e71
SHA1 257e31a661f2afeffb62b044c2a3b866feab487f
SHA512 a187078f08ab9b5db46e2dd64757883d15e341c842f018784edd26431b766cfa3efb8344e2fcc4c8d7d7dc9b491bc9b1e44541efbd7a848a1b58357bfffd8285
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIv/jbMgX3iFrvcRUtPD+uO+TzCvBDZEx:MuLAZTnbg2Z4EaHvLbDXSFccPyBizCZE
TLSH
T138232B003BE8822BF2BE8F786DF26145867EF6636603D54D1CC451DB4613FC69642AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
nimda.zorvec.name:80
nimda.zorvec.name:22
nimda.zorvec.name:8080
nimda.zorvec.name:8880
nimda.zorvec.name:2052
nimda.zorvec.name:2082
nimda.zorvec.name:2086
nimda.zorvec.name:2095
nimda.zorvec.name:443
nimda.zorvec.name:2053
nimda.zorvec.name:2083
nimda.zorvec.name:2087
nimda.zorvec.name:2096
nimda.zorvec.name:8443
gh0st.zorvec.name:80
gh0st.zorvec.name:22
gh0st.zorvec.name:8080
gh0st.zorvec.name:8880
gh0st.zorvec.name:2052
gh0st.zorvec.name:2082
gh0st.zorvec.name:2086
gh0st.zorvec.name:2095
gh0st.zorvec.name:443
gh0st.zorvec.name:2053
gh0st.zorvec.name:2083
gh0st.zorvec.name:2087
gh0st.zorvec.name:2096
gh0st.zorvec.name:8443
ursnif.zorvec.name:80
ursnif.zorvec.name:22
ursnif.zorvec.name:8080
ursnif.zorvec.name:8880
ursnif.zorvec.name:2052
ursnif.zorvec.name:2082
ursnif.zorvec.name:2086
ursnif.zorvec.name:2095
ursnif.zorvec.name:443
ursnif.zorvec.name:2053
ursnif.zorvec.name:2083
ursnif.zorvec.name:2087
ursnif.zorvec.name:2096
ursnif.zorvec.name:8443
socgholish.zorvec.name:80
socgholish.zorvec.name:22
socgholish.zorvec.name:8080
socgholish.zorvec.name:8880
socgholish.zorvec.name:2052
socgholish.zorvec.name:2082
socgholish.zorvec.name:2086
socgholish.zorvec.name:2095
socgholish.zorvec.name:443
socgholish.zorvec.name:2053
socgholish.zorvec.name:2083
socgholish.zorvec.name:2087
socgholish.zorvec.name:2096
socgholish.zorvec.name:8443

Mutex

c0pk73L60IRb

Attributes

delay
0
install
true
install_file
z8ps7.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  bf32250d1eedcbb7f7e9e792844098ce9592742fa845e29be3defe8466d3fb9e
- Size 45KB
- SHA256 bf32250d1eedcbb7f7e9e792844098ce9592742fa845e29be3defe8466d3fb9e
- MD5 33a5bd83d5eedfe61a1a2d85675f8e71
- SHA1 257e31a661f2afeffb62b044c2a3b866feab487f
- SHA512 a187078f08ab9b5db46e2dd64757883d15e341c842f018784edd26431b766cfa3efb8344e2fcc4c8d7d7dc9b491bc9b1e44541efbd7a848a1b58357bfffd8285
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIv/jbMgX3iFrvcRUtPD+uO+TzCvBDZEx:MuLAZTnbg2Z4EaHvLbDXSFccPyBizCZE
- TLSH
  T138232B003BE8822BF2BE8F786DF26145867EF6636603D54D1CC451DB4613FC69642AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2