asyncrat | 452c9c62ee1daf6341b30a989c3a9c55270129b89c81debcd6423e559d901be3

Sharing

Copy URL Twitter E-mail

General

Target
452c9c62ee1daf6341b30a989c3a9c55270129b89c81debcd6423e559d901be3
Size 45KB
Sample260816-lr5y3avthz
SHA256 452c9c62ee1daf6341b30a989c3a9c55270129b89c81debcd6423e559d901be3
MD5 c0f94ad581c88afe379021a9baede0c5
SHA1 73f900a5ccd264ec528809827391f8f1438dda3e
SHA512 8f7a594ab0f1e86313afb87afc223f4bb55930c135964381922cb7b5c33b5c14d1cdafced9f3a70abc17fad53d71e5f50a708703badbdd834d66e1fd16057630
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9JW8aIXOPIKzjbogt3i5DUVWw8R5DmqeBDZ8x:0u1YJTHcw2lFu3K3b/tSRR5DmDd8x
TLSH
T162233C0037E8822BF27E4F789DF26245857EF6673603D54A1CC4529B4613FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
formbook.zorvec.name:80
formbook.zorvec.name:22
formbook.zorvec.name:8080
formbook.zorvec.name:8880
formbook.zorvec.name:2052
formbook.zorvec.name:2082
formbook.zorvec.name:2086
formbook.zorvec.name:2095
formbook.zorvec.name:443
formbook.zorvec.name:2053
formbook.zorvec.name:2083
formbook.zorvec.name:2087
formbook.zorvec.name:2096
formbook.zorvec.name:8443
nanocore.zorvec.name:80
nanocore.zorvec.name:22
nanocore.zorvec.name:8080
nanocore.zorvec.name:8880
nanocore.zorvec.name:2052
nanocore.zorvec.name:2082
nanocore.zorvec.name:2086
nanocore.zorvec.name:2095
nanocore.zorvec.name:443
nanocore.zorvec.name:2053
nanocore.zorvec.name:2083
nanocore.zorvec.name:2087
nanocore.zorvec.name:2096
nanocore.zorvec.name:8443
ursnif.zorvec.name:80
ursnif.zorvec.name:22
ursnif.zorvec.name:8080
ursnif.zorvec.name:8880
ursnif.zorvec.name:2052
ursnif.zorvec.name:2082
ursnif.zorvec.name:2086
ursnif.zorvec.name:2095
ursnif.zorvec.name:443
ursnif.zorvec.name:2053
ursnif.zorvec.name:2083
ursnif.zorvec.name:2087
ursnif.zorvec.name:2096
ursnif.zorvec.name:8443

Mutex

MWBH3uOxAh0p

Attributes

delay
0
install
true
install_file
alzjdk.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  452c9c62ee1daf6341b30a989c3a9c55270129b89c81debcd6423e559d901be3
- Size 45KB
- SHA256 452c9c62ee1daf6341b30a989c3a9c55270129b89c81debcd6423e559d901be3
- MD5 c0f94ad581c88afe379021a9baede0c5
- SHA1 73f900a5ccd264ec528809827391f8f1438dda3e
- SHA512 8f7a594ab0f1e86313afb87afc223f4bb55930c135964381922cb7b5c33b5c14d1cdafced9f3a70abc17fad53d71e5f50a708703badbdd834d66e1fd16057630
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9JW8aIXOPIKzjbogt3i5DUVWw8R5DmqeBDZ8x:0u1YJTHcw2lFu3K3b/tSRR5DmDd8x
- TLSH
  T162233C0037E8822BF27E4F789DF26245857EF6673603D54A1CC4529B4613FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2