asyncrat | 8957332958d23545473203f417709067c3dc83a644a5e220149b1de079d07c8e

Sharing

Copy URL Twitter E-mail

General

Target
8957332958d23545473203f417709067c3dc83a644a5e220149b1de079d07c8e
Size 45KB
Sample260821-lpaedaag29
SHA256 8957332958d23545473203f417709067c3dc83a644a5e220149b1de079d07c8e
MD5 17719327e5d40f4709e2b11779e7ddc6
SHA1 a38acca64ec055b10d1e1907c07661f3d235d82a
SHA512 098e2e2265841f5db0d8d1cfd56734d8d60f67f9dbf41fa78d72d4a4d841b01925e8f114ca3b28191a6d3e078d2eae08f149f05bf864d95c6a52d15463a2c946
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPIlzjbUgX3imGjBvnxpmcClBDZsx:EufspTf2g2v0hl3b7XSDj5RCrdsx
TLSH
T19F233A1037E9C12BF2BE5F78ADF26145467AF6632603D64D1CC4119B4A13FC68A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
blaster.zorvec.name:80
blaster.zorvec.name:22
blaster.zorvec.name:8080
blaster.zorvec.name:8880
blaster.zorvec.name:2052
blaster.zorvec.name:2082
blaster.zorvec.name:2086
blaster.zorvec.name:2095
blaster.zorvec.name:443
blaster.zorvec.name:2053
blaster.zorvec.name:2083
blaster.zorvec.name:2087
blaster.zorvec.name:2096
blaster.zorvec.name:8443
client.zorvec.name:80
client.zorvec.name:22
client.zorvec.name:8080
client.zorvec.name:8880
client.zorvec.name:2052
client.zorvec.name:2082
client.zorvec.name:2086
client.zorvec.name:2095
client.zorvec.name:443
client.zorvec.name:2053
client.zorvec.name:2083
client.zorvec.name:2087
client.zorvec.name:2096
client.zorvec.name:8443
notpetya.zorvec.name:80
notpetya.zorvec.name:22
notpetya.zorvec.name:8080
notpetya.zorvec.name:8880
notpetya.zorvec.name:2052
notpetya.zorvec.name:2082
notpetya.zorvec.name:2086
notpetya.zorvec.name:2095
notpetya.zorvec.name:443
notpetya.zorvec.name:2053
notpetya.zorvec.name:2083
notpetya.zorvec.name:2087
notpetya.zorvec.name:2096
notpetya.zorvec.name:8443
darkside.zorvec.name:80
darkside.zorvec.name:22
darkside.zorvec.name:8080
darkside.zorvec.name:8880
darkside.zorvec.name:2052
darkside.zorvec.name:2082
darkside.zorvec.name:2086
darkside.zorvec.name:2095
darkside.zorvec.name:443
darkside.zorvec.name:2053
darkside.zorvec.name:2083
darkside.zorvec.name:2087
darkside.zorvec.name:2096
darkside.zorvec.name:8443

Mutex

EeEMDwcvv82U

Attributes

delay
0
install
true
install_file
xuq7kx0.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  8957332958d23545473203f417709067c3dc83a644a5e220149b1de079d07c8e
- Size 45KB
- SHA256 8957332958d23545473203f417709067c3dc83a644a5e220149b1de079d07c8e
- MD5 17719327e5d40f4709e2b11779e7ddc6
- SHA1 a38acca64ec055b10d1e1907c07661f3d235d82a
- SHA512 098e2e2265841f5db0d8d1cfd56734d8d60f67f9dbf41fa78d72d4a4d841b01925e8f114ca3b28191a6d3e078d2eae08f149f05bf864d95c6a52d15463a2c946
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPIlzjbUgX3imGjBvnxpmcClBDZsx:EufspTf2g2v0hl3b7XSDj5RCrdsx
- TLSH
  T19F233A1037E9C12BF2BE5F78ADF26145467AF6632603D64D1CC4119B4A13FC68A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2