asyncrat | 79f7be36aaf7da359d4aec0b7693cdd6024782d87712525514af2274b34a878a

Sharing

Copy URL Twitter E-mail

General

Target
79f7be36aaf7da359d4aec0b7693cdd6024782d87712525514af2274b34a878a
Size 45KB
Sample260831-gtb2jsdr51
SHA256 79f7be36aaf7da359d4aec0b7693cdd6024782d87712525514af2274b34a878a
MD5 1969bdbcf94f4a21aec9e8f6b49e1f28
SHA1 8d2a80d3d77aaa816431d9a0e238e24686893d21
SHA512 cc6322f7c692ca1aec2534052a0a4fdbad71c260b57db7087e9917f3b39feae8898b9b2b303328182946fe3b47c68066b0cbd26aaa2feb8032a4d7ef5ade9864
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvmjbTgX3i5DKfBoH71FNO2JBDZEx:MuLAZTnbg2Z4EaHvKbMXS5DK2HhFfdEx
TLSH
T1E3233B003BE8812BF2BE4F78A9F26145867EF5637603D5491CC412D75B23FC68A426FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
ursnif.zorvec.name:80
ursnif.zorvec.name:22
ursnif.zorvec.name:8080
ursnif.zorvec.name:8880
ursnif.zorvec.name:2052
ursnif.zorvec.name:2082
ursnif.zorvec.name:2086
ursnif.zorvec.name:2095
ursnif.zorvec.name:443
ursnif.zorvec.name:2053
ursnif.zorvec.name:2083
ursnif.zorvec.name:2087
ursnif.zorvec.name:2096
ursnif.zorvec.name:8443
cryptolocker.zorvec.name:80
cryptolocker.zorvec.name:22
cryptolocker.zorvec.name:8080
cryptolocker.zorvec.name:8880
cryptolocker.zorvec.name:2052
cryptolocker.zorvec.name:2082
cryptolocker.zorvec.name:2086
cryptolocker.zorvec.name:2095
cryptolocker.zorvec.name:443
cryptolocker.zorvec.name:2053
cryptolocker.zorvec.name:2083
cryptolocker.zorvec.name:2087
cryptolocker.zorvec.name:2096
cryptolocker.zorvec.name:8443
gh0st.zorvec.name:80
gh0st.zorvec.name:22
gh0st.zorvec.name:8080
gh0st.zorvec.name:8880
gh0st.zorvec.name:2052
gh0st.zorvec.name:2082
gh0st.zorvec.name:2086
gh0st.zorvec.name:2095
gh0st.zorvec.name:443
gh0st.zorvec.name:2053
gh0st.zorvec.name:2083
gh0st.zorvec.name:2087
gh0st.zorvec.name:2096
gh0st.zorvec.name:8443
revil.zorvec.name:80
revil.zorvec.name:22
revil.zorvec.name:8080
revil.zorvec.name:8880
revil.zorvec.name:2052
revil.zorvec.name:2082
revil.zorvec.name:2086
revil.zorvec.name:2095
revil.zorvec.name:443
revil.zorvec.name:2053
revil.zorvec.name:2083
revil.zorvec.name:2087
revil.zorvec.name:2096
revil.zorvec.name:8443

Mutex

ETPSsSNuhUYk

Attributes

delay
0
install
true
install_file
a7627.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  79f7be36aaf7da359d4aec0b7693cdd6024782d87712525514af2274b34a878a
- Size 45KB
- SHA256 79f7be36aaf7da359d4aec0b7693cdd6024782d87712525514af2274b34a878a
- MD5 1969bdbcf94f4a21aec9e8f6b49e1f28
- SHA1 8d2a80d3d77aaa816431d9a0e238e24686893d21
- SHA512 cc6322f7c692ca1aec2534052a0a4fdbad71c260b57db7087e9917f3b39feae8898b9b2b303328182946fe3b47c68066b0cbd26aaa2feb8032a4d7ef5ade9864
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvmjbTgX3i5DKfBoH71FNO2JBDZEx:MuLAZTnbg2Z4EaHvKbMXS5DK2HhFfdEx
- TLSH
  T1E3233B003BE8812BF2BE4F78A9F26145867EF5637603D5491CC412D75B23FC68A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2