asyncrat | 578ef9b8068c4fa393d8034e9852bcd56b4c408f91729bfb84fe657c698db7ba

Sharing

Copy URL Twitter E-mail

General

Target
578ef9b8068c4fa393d8034e9852bcd56b4c408f91729bfb84fe657c698db7ba
Size 45KB
Sample260816-trnnsassfv
SHA256 578ef9b8068c4fa393d8034e9852bcd56b4c408f91729bfb84fe657c698db7ba
MD5 a6a4ef9d8905dfb5e9932e511d9470db
SHA1 3f0325d1255d6b610b4389f1007461faf88fe96c
SHA512 89832c4ae4c568c623bc21fe582c27d5428032e87bc68d865e098714426a96db74814684b10c0a5e623f7d81b23b86adfa7a048430f1273f68b495e1efbfa7bb
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV4UdA8Mal58FnPIMHzjbDgX3v/J299VumqYBDZUx:cu7e5TH2A2XUp7l5wAMH3bcXfR20idUx
TLSH
T146233B003BE8812BF27F4B789DF26145867AF2633603D55A1CC4529B5713FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
shamoon.zorvec.name:80
shamoon.zorvec.name:22
shamoon.zorvec.name:8080
shamoon.zorvec.name:8880
shamoon.zorvec.name:2052
shamoon.zorvec.name:2082
shamoon.zorvec.name:2086
shamoon.zorvec.name:2095
shamoon.zorvec.name:443
shamoon.zorvec.name:2053
shamoon.zorvec.name:2083
shamoon.zorvec.name:2087
shamoon.zorvec.name:2096
shamoon.zorvec.name:8443
socgholish.zorvec.name:80
socgholish.zorvec.name:22
socgholish.zorvec.name:8080
socgholish.zorvec.name:8880
socgholish.zorvec.name:2052
socgholish.zorvec.name:2082
socgholish.zorvec.name:2086
socgholish.zorvec.name:2095
socgholish.zorvec.name:443
socgholish.zorvec.name:2053
socgholish.zorvec.name:2083
socgholish.zorvec.name:2087
socgholish.zorvec.name:2096
socgholish.zorvec.name:8443
fakeupdates.zorvec.name:80
fakeupdates.zorvec.name:22
fakeupdates.zorvec.name:8080
fakeupdates.zorvec.name:8880
fakeupdates.zorvec.name:2052
fakeupdates.zorvec.name:2082
fakeupdates.zorvec.name:2086
fakeupdates.zorvec.name:2095
fakeupdates.zorvec.name:443
fakeupdates.zorvec.name:2053
fakeupdates.zorvec.name:2083
fakeupdates.zorvec.name:2087
fakeupdates.zorvec.name:2096
fakeupdates.zorvec.name:8443

Mutex

i7MKhLA6S1Ff

Attributes

delay
0
install
true
install_file
maxfs.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  578ef9b8068c4fa393d8034e9852bcd56b4c408f91729bfb84fe657c698db7ba
- Size 45KB
- SHA256 578ef9b8068c4fa393d8034e9852bcd56b4c408f91729bfb84fe657c698db7ba
- MD5 a6a4ef9d8905dfb5e9932e511d9470db
- SHA1 3f0325d1255d6b610b4389f1007461faf88fe96c
- SHA512 89832c4ae4c568c623bc21fe582c27d5428032e87bc68d865e098714426a96db74814684b10c0a5e623f7d81b23b86adfa7a048430f1273f68b495e1efbfa7bb
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV4UdA8Mal58FnPIMHzjbDgX3v/J299VumqYBDZUx:cu7e5TH2A2XUp7l5wAMH3bcXfR20idUx
- TLSH
  T146233B003BE8812BF27F4B789DF26145867AF2633603D55A1CC4529B5713FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2