asyncrat | 7262c3ef07374a48ef05cf5c7540ebeb680879da2e9e8c14c892cd2c467af96d

Sharing

Copy URL Twitter E-mail

General

Target
7262c3ef07374a48ef05cf5c7540ebeb680879da2e9e8c14c892cd2c467af96d
Size 45KB
Sample260830-1b6b8aaj71
SHA256 7262c3ef07374a48ef05cf5c7540ebeb680879da2e9e8c14c892cd2c467af96d
MD5 709193d225d50ce3271ed1450483e9ff
SHA1 8651f13728a9edd19e196d44744381c542c6c144
SHA512 40852248a400deb095b5d303f8c88daca1e3049a47ece27abe94c6cf444043559fe0e7af2a7d8b501f3be16061c89a0ff78211bcdc4015810aaaabda6d09e30f
SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9Xozfy3CKPItSjbVgX3iD1YPQ6QKBDZ8x:0uPrpT/qY2ZTRt+byXSGPVd8x
TLSH
T199231A003BE9C127F2BE8F789DF26145467AE6633A03D6491CC4119B5713FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
gootloader.zorvec.name:80
gootloader.zorvec.name:22
gootloader.zorvec.name:8080
gootloader.zorvec.name:8880
gootloader.zorvec.name:2052
gootloader.zorvec.name:2082
gootloader.zorvec.name:2086
gootloader.zorvec.name:2095
gootloader.zorvec.name:443
gootloader.zorvec.name:2053
gootloader.zorvec.name:2083
gootloader.zorvec.name:2087
gootloader.zorvec.name:2096
gootloader.zorvec.name:8443
industroyer.zorvec.name:80
industroyer.zorvec.name:22
industroyer.zorvec.name:8080
industroyer.zorvec.name:8880
industroyer.zorvec.name:2052
industroyer.zorvec.name:2082
industroyer.zorvec.name:2086
industroyer.zorvec.name:2095
industroyer.zorvec.name:443
industroyer.zorvec.name:2053
industroyer.zorvec.name:2083
industroyer.zorvec.name:2087
industroyer.zorvec.name:2096
industroyer.zorvec.name:8443
malware.zorvec.name:80
malware.zorvec.name:22
malware.zorvec.name:8080
malware.zorvec.name:8880
malware.zorvec.name:2052
malware.zorvec.name:2082
malware.zorvec.name:2086
malware.zorvec.name:2095
malware.zorvec.name:443
malware.zorvec.name:2053
malware.zorvec.name:2083
malware.zorvec.name:2087
malware.zorvec.name:2096
malware.zorvec.name:8443

Mutex

VNDUhO3K1PUf

Attributes

delay
0
install
true
install_file
k8v18va.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  7262c3ef07374a48ef05cf5c7540ebeb680879da2e9e8c14c892cd2c467af96d
- Size 45KB
- SHA256 7262c3ef07374a48ef05cf5c7540ebeb680879da2e9e8c14c892cd2c467af96d
- MD5 709193d225d50ce3271ed1450483e9ff
- SHA1 8651f13728a9edd19e196d44744381c542c6c144
- SHA512 40852248a400deb095b5d303f8c88daca1e3049a47ece27abe94c6cf444043559fe0e7af2a7d8b501f3be16061c89a0ff78211bcdc4015810aaaabda6d09e30f
- SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9Xozfy3CKPItSjbVgX3iD1YPQ6QKBDZ8x:0uPrpT/qY2ZTRt+byXSGPVd8x
- TLSH
  T199231A003BE9C127F2BE8F789DF26145467AE6633A03D6491CC4119B5713FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2