asyncrat | 78b46cc01fa505611824799cdd414f7fccceabd23c71f3983a69bd56f28b86e2

Sharing

Copy URL Twitter E-mail

General

Target
78b46cc01fa505611824799cdd414f7fccceabd23c71f3983a69bd56f28b86e2
Size 45KB
Sample260821-n9dcwazapb
SHA256 78b46cc01fa505611824799cdd414f7fccceabd23c71f3983a69bd56f28b86e2
MD5 51df6eb974c7035868fa0ddf22f02eb0
SHA1 f346dc75b8df27693db16247fc2f1ef2c14d603b
SHA512 1a22888903e3d4ca5932f35d2e5195018a2e8522ef0e7e6ae083a7b3ba607c706dcc63fffc0d7d7551b98550fecdaf085dd3bc1c9088de7ec9df83f3664ec471
SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbZgX3i7JYGdgKxsn0geBDZgx:QulCJTHl42FqF9Ff3b2XS7JdWJ0gwdgx
TLSH
T1E923F90037E8812BF2BE4F78ADF26145467AF6633A03D5491CC452D75623FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
hack.zorvec.name:80
hack.zorvec.name:22
hack.zorvec.name:8080
hack.zorvec.name:8880
hack.zorvec.name:2052
hack.zorvec.name:2082
hack.zorvec.name:2086
hack.zorvec.name:2095
hack.zorvec.name:443
hack.zorvec.name:2053
hack.zorvec.name:2083
hack.zorvec.name:2087
hack.zorvec.name:2096
hack.zorvec.name:8443
melissa.zorvec.name:80
melissa.zorvec.name:22
melissa.zorvec.name:8080
melissa.zorvec.name:8880
melissa.zorvec.name:2052
melissa.zorvec.name:2082
melissa.zorvec.name:2086
melissa.zorvec.name:2095
melissa.zorvec.name:443
melissa.zorvec.name:2053
melissa.zorvec.name:2083
melissa.zorvec.name:2087
melissa.zorvec.name:2096
melissa.zorvec.name:8443
fakeupdates.zorvec.name:80
fakeupdates.zorvec.name:22
fakeupdates.zorvec.name:8080
fakeupdates.zorvec.name:8880
fakeupdates.zorvec.name:2052
fakeupdates.zorvec.name:2082
fakeupdates.zorvec.name:2086
fakeupdates.zorvec.name:2095
fakeupdates.zorvec.name:443
fakeupdates.zorvec.name:2053
fakeupdates.zorvec.name:2083
fakeupdates.zorvec.name:2087
fakeupdates.zorvec.name:2096
fakeupdates.zorvec.name:8443
conficker.zorvec.name:80
conficker.zorvec.name:22
conficker.zorvec.name:8080
conficker.zorvec.name:8880
conficker.zorvec.name:2052
conficker.zorvec.name:2082
conficker.zorvec.name:2086
conficker.zorvec.name:2095
conficker.zorvec.name:443
conficker.zorvec.name:2053
conficker.zorvec.name:2083
conficker.zorvec.name:2087
conficker.zorvec.name:2096
conficker.zorvec.name:8443

Mutex

HwZLVa0Rr1q2

Attributes

delay
0
install
true
install_file
k8rl8v.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  78b46cc01fa505611824799cdd414f7fccceabd23c71f3983a69bd56f28b86e2
- Size 45KB
- SHA256 78b46cc01fa505611824799cdd414f7fccceabd23c71f3983a69bd56f28b86e2
- MD5 51df6eb974c7035868fa0ddf22f02eb0
- SHA1 f346dc75b8df27693db16247fc2f1ef2c14d603b
- SHA512 1a22888903e3d4ca5932f35d2e5195018a2e8522ef0e7e6ae083a7b3ba607c706dcc63fffc0d7d7551b98550fecdaf085dd3bc1c9088de7ec9df83f3664ec471
- SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbZgX3i7JYGdgKxsn0geBDZgx:QulCJTHl42FqF9Ff3b2XS7JdWJ0gwdgx
- TLSH
  T1E923F90037E8812BF2BE4F78ADF26145467AF6633A03D5491CC452D75623FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2