asyncrat | eb54378a362e2b0a4530fd7c979538b50af5052df6feeee37f962a64d5b4f8fc

Sharing

Copy URL Twitter E-mail

General

Target
eb54378a362e2b0a4530fd7c979538b50af5052df6feeee37f962a64d5b4f8fc
Size 45KB
Sample260816-wtzvyatzew
SHA256 eb54378a362e2b0a4530fd7c979538b50af5052df6feeee37f962a64d5b4f8fc
MD5 dadddb12b9f1f20c0bce31fab012ad00
SHA1 df0332c42ab6f6cac95f5fa6edc2ac8e73827f08
SHA512 20a4b744d4732bfd43947882cdacf6170e4d903ca10d32acd7a6568e1f0fd65e6981c21ed097c22a56cd90f62b6b4077837448b8bee8e753326c340e6e38a797
SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PIZzjbngX3ijBsYhK6kBHXg5+h3BDZUx:cu6YepTPso2GQZ3bgXSjSYhnkhXtdUx
TLSH
T1D4231B003BE8813AF2BE4FB49CF26145867AF5633603D6496CC451DB5623BC6DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
remote.zorvec.name:80
remote.zorvec.name:22
remote.zorvec.name:8080
remote.zorvec.name:8880
remote.zorvec.name:2052
remote.zorvec.name:2082
remote.zorvec.name:2086
remote.zorvec.name:2095
remote.zorvec.name:443
remote.zorvec.name:2053
remote.zorvec.name:2083
remote.zorvec.name:2087
remote.zorvec.name:2096
remote.zorvec.name:8443
blaster.zorvec.name:80
blaster.zorvec.name:22
blaster.zorvec.name:8080
blaster.zorvec.name:8880
blaster.zorvec.name:2052
blaster.zorvec.name:2082
blaster.zorvec.name:2086
blaster.zorvec.name:2095
blaster.zorvec.name:443
blaster.zorvec.name:2053
blaster.zorvec.name:2083
blaster.zorvec.name:2087
blaster.zorvec.name:2096
blaster.zorvec.name:8443
fakeupdates.zorvec.name:80
fakeupdates.zorvec.name:22
fakeupdates.zorvec.name:8080
fakeupdates.zorvec.name:8880
fakeupdates.zorvec.name:2052
fakeupdates.zorvec.name:2082
fakeupdates.zorvec.name:2086
fakeupdates.zorvec.name:2095
fakeupdates.zorvec.name:443
fakeupdates.zorvec.name:2053
fakeupdates.zorvec.name:2083
fakeupdates.zorvec.name:2087
fakeupdates.zorvec.name:2096
fakeupdates.zorvec.name:8443
klez.zorvec.name:80
klez.zorvec.name:22
klez.zorvec.name:8080
klez.zorvec.name:8880
klez.zorvec.name:2052
klez.zorvec.name:2082
klez.zorvec.name:2086
klez.zorvec.name:2095
klez.zorvec.name:443
klez.zorvec.name:2053
klez.zorvec.name:2083
klez.zorvec.name:2087
klez.zorvec.name:2096
klez.zorvec.name:8443

Mutex

eNEhcYGFU0XV

Attributes

delay
0
install
true
install_file
5w0ngru5.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  eb54378a362e2b0a4530fd7c979538b50af5052df6feeee37f962a64d5b4f8fc
- Size 45KB
- SHA256 eb54378a362e2b0a4530fd7c979538b50af5052df6feeee37f962a64d5b4f8fc
- MD5 dadddb12b9f1f20c0bce31fab012ad00
- SHA1 df0332c42ab6f6cac95f5fa6edc2ac8e73827f08
- SHA512 20a4b744d4732bfd43947882cdacf6170e4d903ca10d32acd7a6568e1f0fd65e6981c21ed097c22a56cd90f62b6b4077837448b8bee8e753326c340e6e38a797
- SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1nT9Qpm9PIZzjbngX3ijBsYhK6kBHXg5+h3BDZUx:cu6YepTPso2GQZ3bgXSjSYhnkhXtdUx
- TLSH
  T1D4231B003BE8813AF2BE4FB49CF26145867AF5633603D6496CC451DB5623BC6DA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2