asyncrat | bdab17da4df9a15ecc36049316c18fc926cf2e576e5e33d9f25649667593dc94

Sharing

Copy URL Twitter E-mail

General

Target
bdab17da4df9a15ecc36049316c18fc926cf2e576e5e33d9f25649667593dc94
Size 45KB
Sample260816-tap6aa1zht
SHA256 bdab17da4df9a15ecc36049316c18fc926cf2e576e5e33d9f25649667593dc94
MD5 ba781cdaac299c62f9044cb614698bd8
SHA1 d425f50494ba2759e7e2af871e0d998a8b93ac56
SHA512 4398fe8ce0d936301d21f2681aad02fa21f681fc157f920e958820861f69cfe2127e3bee84a1310a797b714fe2edfa21275acf8d8311606fdcd03545c55504ba
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI50jb5gX3i45fbA5ZKlvIwhEBDZ8x:0u1YJTHcw2NgG5UbWXS45TA5k1Iwhyd+
TLSH
T163231B0037E8C22BF2BE4F78ADF26145867AF6672603D54D2CC4519B1613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
notpetya.zorvec.name:80
notpetya.zorvec.name:22
notpetya.zorvec.name:8080
notpetya.zorvec.name:8880
notpetya.zorvec.name:2052
notpetya.zorvec.name:2082
notpetya.zorvec.name:2086
notpetya.zorvec.name:2095
notpetya.zorvec.name:443
notpetya.zorvec.name:2053
notpetya.zorvec.name:2083
notpetya.zorvec.name:2087
notpetya.zorvec.name:2096
notpetya.zorvec.name:8443
lokibot.zorvec.name:80
lokibot.zorvec.name:22
lokibot.zorvec.name:8080
lokibot.zorvec.name:8880
lokibot.zorvec.name:2052
lokibot.zorvec.name:2082
lokibot.zorvec.name:2086
lokibot.zorvec.name:2095
lokibot.zorvec.name:443
lokibot.zorvec.name:2053
lokibot.zorvec.name:2083
lokibot.zorvec.name:2087
lokibot.zorvec.name:2096
lokibot.zorvec.name:8443
formbook.zorvec.name:80
formbook.zorvec.name:22
formbook.zorvec.name:8080
formbook.zorvec.name:8880
formbook.zorvec.name:2052
formbook.zorvec.name:2082
formbook.zorvec.name:2086
formbook.zorvec.name:2095
formbook.zorvec.name:443
formbook.zorvec.name:2053
formbook.zorvec.name:2083
formbook.zorvec.name:2087
formbook.zorvec.name:2096
formbook.zorvec.name:8443

Mutex

UbGty7Wb05jE

Attributes

delay
0
install
true
install_file
9tt7d9.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  bdab17da4df9a15ecc36049316c18fc926cf2e576e5e33d9f25649667593dc94
- Size 45KB
- SHA256 bdab17da4df9a15ecc36049316c18fc926cf2e576e5e33d9f25649667593dc94
- MD5 ba781cdaac299c62f9044cb614698bd8
- SHA1 d425f50494ba2759e7e2af871e0d998a8b93ac56
- SHA512 4398fe8ce0d936301d21f2681aad02fa21f681fc157f920e958820861f69cfe2127e3bee84a1310a797b714fe2edfa21275acf8d8311606fdcd03545c55504ba
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI50jb5gX3i45fbA5ZKlvIwhEBDZ8x:0u1YJTHcw2NgG5UbWXS45TA5k1Iwhyd+
- TLSH
  T163231B0037E8C22BF2BE4F78ADF26145867AF6672603D54D2CC4519B1613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2