asyncrat | 7a783a18f114e59dd0e9cd6de02992d56204a6f60ceec6f8f565f0b12a71df8d

Sharing

Copy URL Twitter E-mail

General

Target
7a783a18f114e59dd0e9cd6de02992d56204a6f60ceec6f8f565f0b12a71df8d
Size 45KB
Sample260817-vh697sen4s
SHA256 7a783a18f114e59dd0e9cd6de02992d56204a6f60ceec6f8f565f0b12a71df8d
MD5 8798e12e7693d9d759ec41872ef6da06
SHA1 8ddb5450577fa297d638051d397b2e89648b556a
SHA512 02a7063726a550819e755d21021ff11c324df75dfbb8f2f85f61479a4879f6a4bff828061436bc0122e7100e98d8e553266fb9655dc25524ee9ba34bcf0d418d
SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1RpPEcPIMzjbggX3iSeCYJj/EnYVBDZEx:MuBGJTPho2t8VDZEhM3bHXSSaQsdEx
TLSH
T185233B0037E9822BF2BE4F789CF26145867AF6636603D64A1CC051DB5613FC6CA526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
formbook.zorvec.name:80
formbook.zorvec.name:22
formbook.zorvec.name:8080
formbook.zorvec.name:8880
formbook.zorvec.name:2052
formbook.zorvec.name:2082
formbook.zorvec.name:2086
formbook.zorvec.name:2095
formbook.zorvec.name:443
formbook.zorvec.name:2053
formbook.zorvec.name:2083
formbook.zorvec.name:2087
formbook.zorvec.name:2096
formbook.zorvec.name:8443
qbot.zorvec.name:80
qbot.zorvec.name:22
qbot.zorvec.name:8080
qbot.zorvec.name:8880
qbot.zorvec.name:2052
qbot.zorvec.name:2082
qbot.zorvec.name:2086
qbot.zorvec.name:2095
qbot.zorvec.name:443
qbot.zorvec.name:2053
qbot.zorvec.name:2083
qbot.zorvec.name:2087
qbot.zorvec.name:2096
qbot.zorvec.name:8443
lokibot.zorvec.name:80
lokibot.zorvec.name:22
lokibot.zorvec.name:8080
lokibot.zorvec.name:8880
lokibot.zorvec.name:2052
lokibot.zorvec.name:2082
lokibot.zorvec.name:2086
lokibot.zorvec.name:2095
lokibot.zorvec.name:443
lokibot.zorvec.name:2053
lokibot.zorvec.name:2083
lokibot.zorvec.name:2087
lokibot.zorvec.name:2096
lokibot.zorvec.name:8443
stuxnet.zorvec.name:80
stuxnet.zorvec.name:22
stuxnet.zorvec.name:8080
stuxnet.zorvec.name:8880
stuxnet.zorvec.name:2052
stuxnet.zorvec.name:2082
stuxnet.zorvec.name:2086
stuxnet.zorvec.name:2095
stuxnet.zorvec.name:443
stuxnet.zorvec.name:2053
stuxnet.zorvec.name:2083
stuxnet.zorvec.name:2087
stuxnet.zorvec.name:2096
stuxnet.zorvec.name:8443

Mutex

xid1nc61nXem

Attributes

delay
0
install
true
install_file
o4tu.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7a783a18f114e59dd0e9cd6de02992d56204a6f60ceec6f8f565f0b12a71df8d
- Size 45KB
- SHA256 7a783a18f114e59dd0e9cd6de02992d56204a6f60ceec6f8f565f0b12a71df8d
- MD5 8798e12e7693d9d759ec41872ef6da06
- SHA1 8ddb5450577fa297d638051d397b2e89648b556a
- SHA512 02a7063726a550819e755d21021ff11c324df75dfbb8f2f85f61479a4879f6a4bff828061436bc0122e7100e98d8e553266fb9655dc25524ee9ba34bcf0d418d
- SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVe8V1RpPEcPIMzjbggX3iSeCYJj/EnYVBDZEx:MuBGJTPho2t8VDZEhM3bHXSSaQsdEx
- TLSH
  T185233B0037E9822BF2BE4F789CF26145867AF6636603D64A1CC051DB5613FC6CA526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2