asyncrat | 453f4f9971e4129efe210686451ad851c1836fe8e7d7c9cbec00d599cc112041

Sharing

Copy URL Twitter E-mail

General

Target
453f4f9971e4129efe210686451ad851c1836fe8e7d7c9cbec00d599cc112041
Size 45KB
Sample260821-m5kqqaydkf
SHA256 453f4f9971e4129efe210686451ad851c1836fe8e7d7c9cbec00d599cc112041
MD5 e968fe163e9a7154d95d69c833d7bd2a
SHA1 759ce8e99c7f5af44f19716f84a95fcbc837b4fd
SHA512 9f117d7c65c2be9bce1766145d7193b9f9b48a61531aba92e87db007d75e3b46f01b3bf97675ac38723005fbfe2f47e7d7c8c8c205b0a21eaec87d5fb2d9cc8b
SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPIMzjb2gX3i7c2ozr5Loxi8N8RBDZ8x:0u1YJTHcw2TRvM3bpXSQzr5Lo08Wvd8x
TLSH
T1C8231B0037E9812BF2BE4F7898F26145867AF6673603D58D1CC441DB5623BC6DA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
darkside.zorvec.name:80
darkside.zorvec.name:22
darkside.zorvec.name:8080
darkside.zorvec.name:8880
darkside.zorvec.name:2052
darkside.zorvec.name:2082
darkside.zorvec.name:2086
darkside.zorvec.name:2095
darkside.zorvec.name:443
darkside.zorvec.name:2053
darkside.zorvec.name:2083
darkside.zorvec.name:2087
darkside.zorvec.name:2096
darkside.zorvec.name:8443
gootloader.zorvec.name:80
gootloader.zorvec.name:22
gootloader.zorvec.name:8080
gootloader.zorvec.name:8880
gootloader.zorvec.name:2052
gootloader.zorvec.name:2082
gootloader.zorvec.name:2086
gootloader.zorvec.name:2095
gootloader.zorvec.name:443
gootloader.zorvec.name:2053
gootloader.zorvec.name:2083
gootloader.zorvec.name:2087
gootloader.zorvec.name:2096
gootloader.zorvec.name:8443
notpetya.zorvec.name:80
notpetya.zorvec.name:22
notpetya.zorvec.name:8080
notpetya.zorvec.name:8880
notpetya.zorvec.name:2052
notpetya.zorvec.name:2082
notpetya.zorvec.name:2086
notpetya.zorvec.name:2095
notpetya.zorvec.name:443
notpetya.zorvec.name:2053
notpetya.zorvec.name:2083
notpetya.zorvec.name:2087
notpetya.zorvec.name:2096
notpetya.zorvec.name:8443

Mutex

vj7xyWaDwEzD

Attributes

delay
0
install
true
install_file
0jfvl4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  453f4f9971e4129efe210686451ad851c1836fe8e7d7c9cbec00d599cc112041
- Size 45KB
- SHA256 453f4f9971e4129efe210686451ad851c1836fe8e7d7c9cbec00d599cc112041
- MD5 e968fe163e9a7154d95d69c833d7bd2a
- SHA1 759ce8e99c7f5af44f19716f84a95fcbc837b4fd
- SHA512 9f117d7c65c2be9bce1766145d7193b9f9b48a61531aba92e87db007d75e3b46f01b3bf97675ac38723005fbfe2f47e7d7c8c8c205b0a21eaec87d5fb2d9cc8b
- SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPIMzjb2gX3i7c2ozr5Loxi8N8RBDZ8x:0u1YJTHcw2TRvM3bpXSQzr5Lo08Wvd8x
- TLSH
  T1C8231B0037E9812BF2BE4F7898F26145867AF6673603D58D1CC441DB5623BC6DA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2