asyncrat | e16c8577fb790fa8b3700fd9cc3f984c9a402746484c0e6baa7dceae2b38151f

Sharing

Copy URL Twitter E-mail

General

Target
e16c8577fb790fa8b3700fd9cc3f984c9a402746484c0e6baa7dceae2b38151f
Size 45KB
Sample260816-vejdzaef52
SHA256 e16c8577fb790fa8b3700fd9cc3f984c9a402746484c0e6baa7dceae2b38151f
MD5 55e93a30151055facf6fde6a7be78681
SHA1 9d193bd0d6ec0fd95deb418af7a6453b4b06bacf
SHA512 a23ae3f2d0f8829ad881c1395a1be8377fbc72e321398ac7a0aadacdf9a4d4084852bd0f00143b74c8f9da70c5ae16116e83ad70bcfd9927b82e2e08303f539b
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5o5TN8/nPI6EzjbCgX3iNEY/VoG1QBDZMx:ku40ZTXEb2TeEoTNKA6E3blXSNjtdYdO
TLSH
T1322319003BE8C12BF2BE4F7899F26145867AF6633603D94A1CC451DB4713BC69A52AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
blaster.zorvec.name:80
blaster.zorvec.name:22
blaster.zorvec.name:8080
blaster.zorvec.name:8880
blaster.zorvec.name:2052
blaster.zorvec.name:2082
blaster.zorvec.name:2086
blaster.zorvec.name:2095
blaster.zorvec.name:443
blaster.zorvec.name:2053
blaster.zorvec.name:2083
blaster.zorvec.name:2087
blaster.zorvec.name:2096
blaster.zorvec.name:8443
sodinokibi.zorvec.name:80
sodinokibi.zorvec.name:22
sodinokibi.zorvec.name:8080
sodinokibi.zorvec.name:8880
sodinokibi.zorvec.name:2052
sodinokibi.zorvec.name:2082
sodinokibi.zorvec.name:2086
sodinokibi.zorvec.name:2095
sodinokibi.zorvec.name:443
sodinokibi.zorvec.name:2053
sodinokibi.zorvec.name:2083
sodinokibi.zorvec.name:2087
sodinokibi.zorvec.name:2096
sodinokibi.zorvec.name:8443
hermeticwiper.zorvec.name:80
hermeticwiper.zorvec.name:22
hermeticwiper.zorvec.name:8080
hermeticwiper.zorvec.name:8880
hermeticwiper.zorvec.name:2052
hermeticwiper.zorvec.name:2082
hermeticwiper.zorvec.name:2086
hermeticwiper.zorvec.name:2095
hermeticwiper.zorvec.name:443
hermeticwiper.zorvec.name:2053
hermeticwiper.zorvec.name:2083
hermeticwiper.zorvec.name:2087
hermeticwiper.zorvec.name:2096
hermeticwiper.zorvec.name:8443
mirai.zorvec.name:80
mirai.zorvec.name:22
mirai.zorvec.name:8080
mirai.zorvec.name:8880
mirai.zorvec.name:2052
mirai.zorvec.name:2082
mirai.zorvec.name:2086
mirai.zorvec.name:2095
mirai.zorvec.name:443
mirai.zorvec.name:2053
mirai.zorvec.name:2083
mirai.zorvec.name:2087
mirai.zorvec.name:2096
mirai.zorvec.name:8443

Mutex

7puApodqYjgb

Attributes

delay
0
install
true
install_file
5ywju.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  e16c8577fb790fa8b3700fd9cc3f984c9a402746484c0e6baa7dceae2b38151f
- Size 45KB
- SHA256 e16c8577fb790fa8b3700fd9cc3f984c9a402746484c0e6baa7dceae2b38151f
- MD5 55e93a30151055facf6fde6a7be78681
- SHA1 9d193bd0d6ec0fd95deb418af7a6453b4b06bacf
- SHA512 a23ae3f2d0f8829ad881c1395a1be8377fbc72e321398ac7a0aadacdf9a4d4084852bd0f00143b74c8f9da70c5ae16116e83ad70bcfd9927b82e2e08303f539b
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5o5TN8/nPI6EzjbCgX3iNEY/VoG1QBDZMx:ku40ZTXEb2TeEoTNKA6E3blXSNjtdYdO
- TLSH
  T1322319003BE8C12BF2BE4F7899F26145867AF6633603D94A1CC451DB4713BC69A52AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2