asyncrat | 27affa9b163d97ead05521e5577a8fba01b4b748a94a0b60c0b556d7bcffb5be

Sharing

Copy URL Twitter E-mail

General

Target
27affa9b163d97ead05521e5577a8fba01b4b748a94a0b60c0b556d7bcffb5be
Size 45KB
Sample260831-ssddrsvcke
SHA256 27affa9b163d97ead05521e5577a8fba01b4b748a94a0b60c0b556d7bcffb5be
MD5 7419275f199e9159a869707900f4f9ad
SHA1 5d13d72d60d679fa55660b560ef2a347d504e81f
SHA512 62cf158d9382ecd5b6dfc27f2bd74eba1c10cc148645c23e3b26f9174f9a5b219092a71aa9e9cf7d757c704999c90e60484a76ba19951bf9d82fea8360aac75e
SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPI4zjbagX3ijlBZ5BqTuyBDZsx:EulCJTHl42MRv43bNXSjlhjMdsx
TLSH
T1BE232B0037E8C127F2BE5F78A8F26145867AB2673603D5892CC441DB5723FC68A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
sasser.zorvec.name:80
sasser.zorvec.name:22
sasser.zorvec.name:8080
sasser.zorvec.name:8880
sasser.zorvec.name:2052
sasser.zorvec.name:2082
sasser.zorvec.name:2086
sasser.zorvec.name:2095
sasser.zorvec.name:443
sasser.zorvec.name:2053
sasser.zorvec.name:2083
sasser.zorvec.name:2087
sasser.zorvec.name:2096
sasser.zorvec.name:8443
conti.zorvec.name:80
conti.zorvec.name:22
conti.zorvec.name:8080
conti.zorvec.name:8880
conti.zorvec.name:2052
conti.zorvec.name:2082
conti.zorvec.name:2086
conti.zorvec.name:2095
conti.zorvec.name:443
conti.zorvec.name:2053
conti.zorvec.name:2083
conti.zorvec.name:2087
conti.zorvec.name:2096
conti.zorvec.name:8443
blaster.zorvec.name:80
blaster.zorvec.name:22
blaster.zorvec.name:8080
blaster.zorvec.name:8880
blaster.zorvec.name:2052
blaster.zorvec.name:2082
blaster.zorvec.name:2086
blaster.zorvec.name:2095
blaster.zorvec.name:443
blaster.zorvec.name:2053
blaster.zorvec.name:2083
blaster.zorvec.name:2087
blaster.zorvec.name:2096
blaster.zorvec.name:8443
emotet.zorvec.name:80
emotet.zorvec.name:22
emotet.zorvec.name:8080
emotet.zorvec.name:8880
emotet.zorvec.name:2052
emotet.zorvec.name:2082
emotet.zorvec.name:2086
emotet.zorvec.name:2095
emotet.zorvec.name:443
emotet.zorvec.name:2053
emotet.zorvec.name:2083
emotet.zorvec.name:2087
emotet.zorvec.name:2096
emotet.zorvec.name:8443

Mutex

8cs5ixIIOzsA

Attributes

delay
0
install
true
install_file
0yc8v4.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  27affa9b163d97ead05521e5577a8fba01b4b748a94a0b60c0b556d7bcffb5be
- Size 45KB
- SHA256 27affa9b163d97ead05521e5577a8fba01b4b748a94a0b60c0b556d7bcffb5be
- MD5 7419275f199e9159a869707900f4f9ad
- SHA1 5d13d72d60d679fa55660b560ef2a347d504e81f
- SHA512 62cf158d9382ecd5b6dfc27f2bd74eba1c10cc148645c23e3b26f9174f9a5b219092a71aa9e9cf7d757c704999c90e60484a76ba19951bf9d82fea8360aac75e
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPI4zjbagX3ijlBZ5BqTuyBDZsx:EulCJTHl42MRv43bNXSjlhjMdsx
- TLSH
  T1BE232B0037E8C127F2BE5F78A8F26145867AB2673603D5892CC441DB5723FC68A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2