asyncrat | a46af1b1b1ccdb2c2f60457a8efa82c68c406413e947cf026248c91a30dc053e

Sharing

Copy URL Twitter E-mail

General

Target
a46af1b1b1ccdb2c2f60457a8efa82c68c406413e947cf026248c91a30dc053e
Size 45KB
Sample260821-ppwjdszfja
SHA256 a46af1b1b1ccdb2c2f60457a8efa82c68c406413e947cf026248c91a30dc053e
MD5 8db6acd837d94deb63258e9d19d65a6a
SHA1 5a7d83619bd05c6d6088daa74751af4eb155c92b
SHA512 7571b93d5fe0b9738fa0bfe910d903e4f6e91eafcb51e976c2892aab0a0ac38259f361cb7908fde4e8b2f228600b6c94a7ba40f69313f511381352992e3065b3
SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjr9wScq/z1OPIszjbOgp3i/aFbSckRRyMlvBDZcx:DuAqJT84v2wi9K3s3bxpS/aBSckSUZde
TLSH
T188232A003BE9C22BF2BE5F78A9F26145867AB2633603D6491CC451D71713BC68A526FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

ads.zorvec.name:80
ads.zorvec.name:22
ads.zorvec.name:8080
ads.zorvec.name:8880
ads.zorvec.name:2052
ads.zorvec.name:2082
ads.zorvec.name:2086
ads.zorvec.name:2095
ads.zorvec.name:443
ads.zorvec.name:2053
ads.zorvec.name:2083
ads.zorvec.name:2087
ads.zorvec.name:2096
ads.zorvec.name:8443
www.ads.zorvec.name:80
www.ads.zorvec.name:22
www.ads.zorvec.name:8080
www.ads.zorvec.name:8880
www.ads.zorvec.name:2052
www.ads.zorvec.name:2082
www.ads.zorvec.name:2086
www.ads.zorvec.name:2095
www.ads.zorvec.name:443
www.ads.zorvec.name:2053
www.ads.zorvec.name:2083
www.ads.zorvec.name:2087
www.ads.zorvec.name:2096
www.ads.zorvec.name:8443
cryptolocker.ads.zorvec.name:80
cryptolocker.ads.zorvec.name:22
cryptolocker.ads.zorvec.name:8080
cryptolocker.ads.zorvec.name:8880
cryptolocker.ads.zorvec.name:2052
cryptolocker.ads.zorvec.name:2082
cryptolocker.ads.zorvec.name:2086
cryptolocker.ads.zorvec.name:2095
cryptolocker.ads.zorvec.name:443
cryptolocker.ads.zorvec.name:2053
cryptolocker.ads.zorvec.name:2083
cryptolocker.ads.zorvec.name:2087
cryptolocker.ads.zorvec.name:2096
cryptolocker.ads.zorvec.name:8443
sodinokibi.ads.zorvec.name:80
sodinokibi.ads.zorvec.name:22
sodinokibi.ads.zorvec.name:8080
sodinokibi.ads.zorvec.name:8880
sodinokibi.ads.zorvec.name:2052
sodinokibi.ads.zorvec.name:2082
sodinokibi.ads.zorvec.name:2086
sodinokibi.ads.zorvec.name:2095
sodinokibi.ads.zorvec.name:443
sodinokibi.ads.zorvec.name:2053
sodinokibi.ads.zorvec.name:2083
sodinokibi.ads.zorvec.name:2087
sodinokibi.ads.zorvec.name:2096
sodinokibi.ads.zorvec.name:8443
socgholish.ads.zorvec.name:80
socgholish.ads.zorvec.name:22
socgholish.ads.zorvec.name:8080
socgholish.ads.zorvec.name:8880
socgholish.ads.zorvec.name:2052
socgholish.ads.zorvec.name:2082
socgholish.ads.zorvec.name:2086
socgholish.ads.zorvec.name:2095
socgholish.ads.zorvec.name:443
socgholish.ads.zorvec.name:2053
socgholish.ads.zorvec.name:2083
socgholish.ads.zorvec.name:2087
socgholish.ads.zorvec.name:2096
socgholish.ads.zorvec.name:8443
industroyer.ads.zorvec.name:80
industroyer.ads.zorvec.name:22
industroyer.ads.zorvec.name:8080
industroyer.ads.zorvec.name:8880
industroyer.ads.zorvec.name:2052
industroyer.ads.zorvec.name:2082
industroyer.ads.zorvec.name:2086
industroyer.ads.zorvec.name:2095
industroyer.ads.zorvec.name:443
industroyer.ads.zorvec.name:2053
industroyer.ads.zorvec.name:2083
industroyer.ads.zorvec.name:2087
industroyer.ads.zorvec.name:2096
industroyer.ads.zorvec.name:8443

Mutex

Si6OKdsfwJCo

Attributes

delay
0
install
true
install_file
nhsnu0l.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  a46af1b1b1ccdb2c2f60457a8efa82c68c406413e947cf026248c91a30dc053e
- Size 45KB
- SHA256 a46af1b1b1ccdb2c2f60457a8efa82c68c406413e947cf026248c91a30dc053e
- MD5 8db6acd837d94deb63258e9d19d65a6a
- SHA1 5a7d83619bd05c6d6088daa74751af4eb155c92b
- SHA512 7571b93d5fe0b9738fa0bfe910d903e4f6e91eafcb51e976c2892aab0a0ac38259f361cb7908fde4e8b2f228600b6c94a7ba40f69313f511381352992e3065b3
- SSDEEP 768:DuAqJT84XVvWUXR1Zmo2qjr9wScq/z1OPIszjbOgp3i/aFbSckRRyMlvBDZcx:DuAqJT84v2wi9K3s3bxpS/aBSckSUZde
- TLSH
  T188232A003BE9C22BF2BE5F78A9F26145867AB2633603D6491CC451D71713BC68A526FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2