asyncrat | 6cd0961048a3716b7cc83789b5a837b87b50cd89d95733d1362e3ae1a062d3c3

Sharing

Copy URL Twitter E-mail

General

Target
6cd0961048a3716b7cc83789b5a837b87b50cd89d95733d1362e3ae1a062d3c3
Size 45KB
Sample260831-tyslbawdjd
SHA256 6cd0961048a3716b7cc83789b5a837b87b50cd89d95733d1362e3ae1a062d3c3
MD5 f9585d32be91c15dcab9443bed2a3716
SHA1 a6f66e01dc46648cbf409796fbdd271a726a6a79
SHA512 fe0fc524bbefe12f56192448ce2cf3c9ece8bb65951247199e9b0af27c6d56eef1a5edc5b9cb8699efd6bca3e04e678bea992fcff7c7fac0052380ded9d40580
SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEaEPIQojbngX3iBFRxI+2/zTTnKXBDZUx:cu7e5TH2A2q4EapQAbgXSBPO+czTrKR0
TLSH
T1F0232B003BE8826BF2BE4F785CF26145867AF6632503D54E1CC451DB5A13FC69A42AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

zorvec.name:80
zorvec.name:22
zorvec.name:8080
zorvec.name:8880
zorvec.name:2052
zorvec.name:2082
zorvec.name:2086
zorvec.name:2095
zorvec.name:443
zorvec.name:2053
zorvec.name:2083
zorvec.name:2087
zorvec.name:2096
zorvec.name:8443
www.zorvec.name:80
www.zorvec.name:22
www.zorvec.name:8080
www.zorvec.name:8880
www.zorvec.name:2052
www.zorvec.name:2082
www.zorvec.name:2086
www.zorvec.name:2095
www.zorvec.name:443
www.zorvec.name:2053
www.zorvec.name:2083
www.zorvec.name:2087
www.zorvec.name:2096
www.zorvec.name:8443
invasive.zorvec.name:80
invasive.zorvec.name:22
invasive.zorvec.name:8080
invasive.zorvec.name:8880
invasive.zorvec.name:2052
invasive.zorvec.name:2082
invasive.zorvec.name:2086
invasive.zorvec.name:2095
invasive.zorvec.name:443
invasive.zorvec.name:2053
invasive.zorvec.name:2083
invasive.zorvec.name:2087
invasive.zorvec.name:2096
invasive.zorvec.name:8443
client.zorvec.name:80
client.zorvec.name:22
client.zorvec.name:8080
client.zorvec.name:8880
client.zorvec.name:2052
client.zorvec.name:2082
client.zorvec.name:2086
client.zorvec.name:2095
client.zorvec.name:443
client.zorvec.name:2053
client.zorvec.name:2083
client.zorvec.name:2087
client.zorvec.name:2096
client.zorvec.name:8443
darkside.zorvec.name:80
darkside.zorvec.name:22
darkside.zorvec.name:8080
darkside.zorvec.name:8880
darkside.zorvec.name:2052
darkside.zorvec.name:2082
darkside.zorvec.name:2086
darkside.zorvec.name:2095
darkside.zorvec.name:443
darkside.zorvec.name:2053
darkside.zorvec.name:2083
darkside.zorvec.name:2087
darkside.zorvec.name:2096
darkside.zorvec.name:8443

Mutex

7Cqnlppy3TpD

Attributes

delay
0
install
true
install_file
5lrk9.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  6cd0961048a3716b7cc83789b5a837b87b50cd89d95733d1362e3ae1a062d3c3
- Size 45KB
- SHA256 6cd0961048a3716b7cc83789b5a837b87b50cd89d95733d1362e3ae1a062d3c3
- MD5 f9585d32be91c15dcab9443bed2a3716
- SHA1 a6f66e01dc46648cbf409796fbdd271a726a6a79
- SHA512 fe0fc524bbefe12f56192448ce2cf3c9ece8bb65951247199e9b0af27c6d56eef1a5edc5b9cb8699efd6bca3e04e678bea992fcff7c7fac0052380ded9d40580
- SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEaEPIQojbngX3iBFRxI+2/zTTnKXBDZUx:cu7e5TH2A2q4EapQAbgXSBPO+czTrKR0
- TLSH
  T1F0232B003BE8826BF2BE4F785CF26145867AF6632503D54E1CC451DB5A13FC69A42AFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default command_and_control defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Outbound SSH connection to public host
  SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
  command_and_control
behavioral1 behavioral2