asyncrat | 6b52256ecec59b908dff0a0a3645f6aeb3b98158b8cbb39e73f46cf3f15ad9af

Sharing

Copy URL Twitter E-mail

General

Target
6b52256ecec59b908dff0a0a3645f6aeb3b98158b8cbb39e73f46cf3f15ad9af
Size 45KB
Sample260831-jms3laxepd
SHA256 6b52256ecec59b908dff0a0a3645f6aeb3b98158b8cbb39e73f46cf3f15ad9af
MD5 2b189c0930cf289d503eb290cfa235b2
SHA1 acdd452ea23215be6fe26ca0aef7e394b19de169
SHA512 1c8d1aaa52431b26a273e3a480c03749f24fbe5e1062a3fc0912f6a9961bf756a67d7f8cc5e3e176e1e213c44af265ff9f75e8295188e202a407838957577305
SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozHyvCKPIiCjbTgX3iGXeZx4w/KKtcZRF46BDZsx:EufspTf2g20L5iObMXSGOV6Pbdsx
TLSH
T198231C003BE9C12BF2BE5B789DF26245867AF5733A03D54A1CC4119B5613FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
qbot.zorvec.name:80
qbot.zorvec.name:22
qbot.zorvec.name:8080
qbot.zorvec.name:8880
qbot.zorvec.name:2052
qbot.zorvec.name:2082
qbot.zorvec.name:2086
qbot.zorvec.name:2095
qbot.zorvec.name:443
qbot.zorvec.name:2053
qbot.zorvec.name:2083
qbot.zorvec.name:2087
qbot.zorvec.name:2096
qbot.zorvec.name:8443
mydoom.zorvec.name:80
mydoom.zorvec.name:22
mydoom.zorvec.name:8080
mydoom.zorvec.name:8880
mydoom.zorvec.name:2052
mydoom.zorvec.name:2082
mydoom.zorvec.name:2086
mydoom.zorvec.name:2095
mydoom.zorvec.name:443
mydoom.zorvec.name:2053
mydoom.zorvec.name:2083
mydoom.zorvec.name:2087
mydoom.zorvec.name:2096
mydoom.zorvec.name:8443
malware.zorvec.name:80
malware.zorvec.name:22
malware.zorvec.name:8080
malware.zorvec.name:8880
malware.zorvec.name:2052
malware.zorvec.name:2082
malware.zorvec.name:2086
malware.zorvec.name:2095
malware.zorvec.name:443
malware.zorvec.name:2053
malware.zorvec.name:2083
malware.zorvec.name:2087
malware.zorvec.name:2096
malware.zorvec.name:8443
codered.zorvec.name:80
codered.zorvec.name:22
codered.zorvec.name:8080
codered.zorvec.name:8880
codered.zorvec.name:2052
codered.zorvec.name:2082
codered.zorvec.name:2086
codered.zorvec.name:2095
codered.zorvec.name:443
codered.zorvec.name:2053
codered.zorvec.name:2083
codered.zorvec.name:2087
codered.zorvec.name:2096
codered.zorvec.name:8443

Mutex

Du7yUwCTYFG7

Attributes

delay
0
install
true
install_file
3knyn1a.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6b52256ecec59b908dff0a0a3645f6aeb3b98158b8cbb39e73f46cf3f15ad9af
- Size 45KB
- SHA256 6b52256ecec59b908dff0a0a3645f6aeb3b98158b8cbb39e73f46cf3f15ad9af
- MD5 2b189c0930cf289d503eb290cfa235b2
- SHA1 acdd452ea23215be6fe26ca0aef7e394b19de169
- SHA512 1c8d1aaa52431b26a273e3a480c03749f24fbe5e1062a3fc0912f6a9961bf756a67d7f8cc5e3e176e1e213c44af265ff9f75e8295188e202a407838957577305
- SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9oozHyvCKPIiCjbTgX3iGXeZx4w/KKtcZRF46BDZsx:EufspTf2g20L5iObMXSGOV6Pbdsx
- TLSH
  T198231C003BE9C12BF2BE5B789DF26245867AF5733A03D54A1CC4119B5613FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2