asyncrat | 1d722d2b08cbeeb47b1668aed3f2419446068e909480ab83382ea6cdcb8f62d6

Sharing

Copy URL Twitter E-mail

General

Target
1d722d2b08cbeeb47b1668aed3f2419446068e909480ab83382ea6cdcb8f62d6
Size 45KB
Sample260816-wlmweafp7y
SHA256 1d722d2b08cbeeb47b1668aed3f2419446068e909480ab83382ea6cdcb8f62d6
MD5 1f1a125acc446ae84ff2bf9f1c50b308
SHA1 13099af8a493762b0f2158a880a0c271b8a8c88d
SHA512 a1ac7c2545e27fb9da82a1500f4af9e775911c808abaf5e9ab8eb72dc91cd1268e60b9f96c9bfd5c8cc0b32ec0bf31463ab867b1e5e980f3c3f6f7b871f4a6ca
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjb5gX3ihSLxhkO2BDZsx:EufspTf2g2bo6bIwZ3bWXSQLnJYdsx
TLSH
T12A233C0037E8812BF2BE5F74A8F26145867AF6633603D54E2CC452DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
hack.zorvec.name:80
hack.zorvec.name:22
hack.zorvec.name:8080
hack.zorvec.name:8880
hack.zorvec.name:2052
hack.zorvec.name:2082
hack.zorvec.name:2086
hack.zorvec.name:2095
hack.zorvec.name:443
hack.zorvec.name:2053
hack.zorvec.name:2083
hack.zorvec.name:2087
hack.zorvec.name:2096
hack.zorvec.name:8443
azorult.zorvec.name:80
azorult.zorvec.name:22
azorult.zorvec.name:8080
azorult.zorvec.name:8880
azorult.zorvec.name:2052
azorult.zorvec.name:2082
azorult.zorvec.name:2086
azorult.zorvec.name:2095
azorult.zorvec.name:443
azorult.zorvec.name:2053
azorult.zorvec.name:2083
azorult.zorvec.name:2087
azorult.zorvec.name:2096
azorult.zorvec.name:8443
trisis.zorvec.name:80
trisis.zorvec.name:22
trisis.zorvec.name:8080
trisis.zorvec.name:8880
trisis.zorvec.name:2052
trisis.zorvec.name:2082
trisis.zorvec.name:2086
trisis.zorvec.name:2095
trisis.zorvec.name:443
trisis.zorvec.name:2053
trisis.zorvec.name:2083
trisis.zorvec.name:2087
trisis.zorvec.name:2096
trisis.zorvec.name:8443
zbot.zorvec.name:80
zbot.zorvec.name:22
zbot.zorvec.name:8080
zbot.zorvec.name:8880
zbot.zorvec.name:2052
zbot.zorvec.name:2082
zbot.zorvec.name:2086
zbot.zorvec.name:2095
zbot.zorvec.name:443
zbot.zorvec.name:2053
zbot.zorvec.name:2083
zbot.zorvec.name:2087
zbot.zorvec.name:2096
zbot.zorvec.name:8443

Mutex

OZD4S1pZouKc

Attributes

delay
0
install
true
install_file
d33zbkv.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  1d722d2b08cbeeb47b1668aed3f2419446068e909480ab83382ea6cdcb8f62d6
- Size 45KB
- SHA256 1d722d2b08cbeeb47b1668aed3f2419446068e909480ab83382ea6cdcb8f62d6
- MD5 1f1a125acc446ae84ff2bf9f1c50b308
- SHA1 13099af8a493762b0f2158a880a0c271b8a8c88d
- SHA512 a1ac7c2545e27fb9da82a1500f4af9e775911c808abaf5e9ab8eb72dc91cd1268e60b9f96c9bfd5c8cc0b32ec0bf31463ab867b1e5e980f3c3f6f7b871f4a6ca
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9OoopCBK9INJPIZzjb5gX3ihSLxhkO2BDZsx:EufspTf2g2bo6bIwZ3bWXSQLnJYdsx
- TLSH
  T12A233C0037E8812BF2BE5F74A8F26145867AF6633603D54E2CC452DB5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2