asyncrat | 4dd235072ac08c8f783d9ed2f5d75ff2919f4670ec35c9904aee57fd0c164d52

Sharing

Copy URL Twitter E-mail

General

Target
4dd235072ac08c8f783d9ed2f5d75ff2919f4670ec35c9904aee57fd0c164d52
Size 45KB
Sample260821-mn8q8ayanb
SHA256 4dd235072ac08c8f783d9ed2f5d75ff2919f4670ec35c9904aee57fd0c164d52
MD5 039562ce048b6692872c3cbfdaefffee
SHA1 101170c04ce8c81cd4d35a9f5e5a80e920934919
SHA512 029bea6195b1f98c9f97ffe39adaf38fc7a83eeaa530ee8d59fe733285c544231b1bd7474f03b4f4f9250edda8709e3c9070d06582724392cee5da26f7df588e
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q97wz/y3qiPI1zjbkgX3iIppUFb0zCFZEsBDZ8x:0uPrpT/qY2Y0h13brXSI854CFZEqd8x
TLSH
T1E8232B003BE9C12BF2BF4F789DF26145467AF5632A03D64D1CC4119A1723FC69A52AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
connect.zorvec.name:80
connect.zorvec.name:22
connect.zorvec.name:8080
connect.zorvec.name:8880
connect.zorvec.name:2052
connect.zorvec.name:2082
connect.zorvec.name:2086
connect.zorvec.name:2095
connect.zorvec.name:443
connect.zorvec.name:2053
connect.zorvec.name:2083
connect.zorvec.name:2087
connect.zorvec.name:2096
connect.zorvec.name:8443
client.zorvec.name:80
client.zorvec.name:22
client.zorvec.name:8080
client.zorvec.name:8880
client.zorvec.name:2052
client.zorvec.name:2082
client.zorvec.name:2086
client.zorvec.name:2095
client.zorvec.name:443
client.zorvec.name:2053
client.zorvec.name:2083
client.zorvec.name:2087
client.zorvec.name:2096
client.zorvec.name:8443
conficker.zorvec.name:80
conficker.zorvec.name:22
conficker.zorvec.name:8080
conficker.zorvec.name:8880
conficker.zorvec.name:2052
conficker.zorvec.name:2082
conficker.zorvec.name:2086
conficker.zorvec.name:2095
conficker.zorvec.name:443
conficker.zorvec.name:2053
conficker.zorvec.name:2083
conficker.zorvec.name:2087
conficker.zorvec.name:2096
conficker.zorvec.name:8443

Mutex

4hvORkealD8e

Attributes

delay
0
install
true
install_file
tmr0ny0.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  4dd235072ac08c8f783d9ed2f5d75ff2919f4670ec35c9904aee57fd0c164d52
- Size 45KB
- SHA256 4dd235072ac08c8f783d9ed2f5d75ff2919f4670ec35c9904aee57fd0c164d52
- MD5 039562ce048b6692872c3cbfdaefffee
- SHA1 101170c04ce8c81cd4d35a9f5e5a80e920934919
- SHA512 029bea6195b1f98c9f97ffe39adaf38fc7a83eeaa530ee8d59fe733285c544231b1bd7474f03b4f4f9250edda8709e3c9070d06582724392cee5da26f7df588e
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q97wz/y3qiPI1zjbkgX3iIppUFb0zCFZEsBDZ8x:0uPrpT/qY2Y0h13brXSI854CFZEqd8x
- TLSH
  T1E8232B003BE9C12BF2BF4F789DF26145467AF5632A03D64D1CC4119A1723FC69A52AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2