asyncrat | 34ce5a47d6be52314ec5de5128d59a2dd5c553c46f00f939fb38dd2588f0e5f3

Sharing

Copy URL Twitter E-mail

General

Target
34ce5a47d6be52314ec5de5128d59a2dd5c553c46f00f939fb38dd2588f0e5f3
Size 45KB
Sample260821-vt9jpsthqb
SHA256 34ce5a47d6be52314ec5de5128d59a2dd5c553c46f00f939fb38dd2588f0e5f3
MD5 3c3b2d9548749c9c714c3fb1db7dcb75
SHA1 9ee85be6349e049164f8b4f04ea898823a8460ae
SHA512 44cab3a6292b1d07a5953a32965b9ed6dcc1e674d274e8af35d585190a7704cd13e932555843b0f992eac8f0cc0f220a36e945c00bc9ccc5f13490d380d270e5
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXK5oibbb6TN8/nPI6WzjbGgX3iO6ngvqlxxEih:cu7e5TH2A27eEqTNKA6W3bZXSO6n4Wxl
TLSH
T1AA232A003BEC812BF2BE4F7859F26245867AE6633603D94A1CC451DB5713FC69A42AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
fakeupdates.zorvec.name:80
fakeupdates.zorvec.name:22
fakeupdates.zorvec.name:8080
fakeupdates.zorvec.name:8880
fakeupdates.zorvec.name:2052
fakeupdates.zorvec.name:2082
fakeupdates.zorvec.name:2086
fakeupdates.zorvec.name:2095
fakeupdates.zorvec.name:443
fakeupdates.zorvec.name:2053
fakeupdates.zorvec.name:2083
fakeupdates.zorvec.name:2087
fakeupdates.zorvec.name:2096
fakeupdates.zorvec.name:8443
stuxnet.zorvec.name:80
stuxnet.zorvec.name:22
stuxnet.zorvec.name:8080
stuxnet.zorvec.name:8880
stuxnet.zorvec.name:2052
stuxnet.zorvec.name:2082
stuxnet.zorvec.name:2086
stuxnet.zorvec.name:2095
stuxnet.zorvec.name:443
stuxnet.zorvec.name:2053
stuxnet.zorvec.name:2083
stuxnet.zorvec.name:2087
stuxnet.zorvec.name:2096
stuxnet.zorvec.name:8443
gh0st.zorvec.name:80
gh0st.zorvec.name:22
gh0st.zorvec.name:8080
gh0st.zorvec.name:8880
gh0st.zorvec.name:2052
gh0st.zorvec.name:2082
gh0st.zorvec.name:2086
gh0st.zorvec.name:2095
gh0st.zorvec.name:443
gh0st.zorvec.name:2053
gh0st.zorvec.name:2083
gh0st.zorvec.name:2087
gh0st.zorvec.name:2096
gh0st.zorvec.name:8443

Mutex

8pWuiEYDyUEu

Attributes

delay
0
install
true
install_file
5uqnw.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  34ce5a47d6be52314ec5de5128d59a2dd5c553c46f00f939fb38dd2588f0e5f3
- Size 45KB
- SHA256 34ce5a47d6be52314ec5de5128d59a2dd5c553c46f00f939fb38dd2588f0e5f3
- MD5 3c3b2d9548749c9c714c3fb1db7dcb75
- SHA1 9ee85be6349e049164f8b4f04ea898823a8460ae
- SHA512 44cab3a6292b1d07a5953a32965b9ed6dcc1e674d274e8af35d585190a7704cd13e932555843b0f992eac8f0cc0f220a36e945c00bc9ccc5f13490d380d270e5
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFPeeXK5oibbb6TN8/nPI6WzjbGgX3iO6ngvqlxxEih:cu7e5TH2A27eEqTNKA6W3bZXSO6n4Wxl
- TLSH
  T1AA232A003BEC812BF2BE4F7859F26245867AE6633603D94A1CC451DB5713FC69A42AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat command_and_control
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2