asyncrat | cbe5162326e561c0120cf8c2b0df45b92596ea1579b40a9787f166a5db6963e8

Sharing

Copy URL Twitter E-mail

General

Target
cbe5162326e561c0120cf8c2b0df45b92596ea1579b40a9787f166a5db6963e8
Size 45KB
Sample260701-pwdbdsgs71
SHA256 cbe5162326e561c0120cf8c2b0df45b92596ea1579b40a9787f166a5db6963e8
MD5 5c573c883028e474da1e3aafa1f19c43
SHA1 5a2b8edfe13429525e15167eed6d6b9b0265a0fe
SHA512 5283370c2b6496b15d956e3f8d463bf6f3a0bb141494f9771c62ce1f7c4033cde9507131c52a0cf1c8ad7a50d11e344b84e6c9237fb6545b3b6509d4b903924a
SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbrgI3iQMep12YdbBDZsx:EulCJTHl42mjqb3u3bUISQn3Ndsx
TLSH
T15B23190037E8812BF2BE4F789CF26245867AF6673603D58E1CC4519B5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

textureta.com:80
textureta.com:22
textureta.com:8080
textureta.com:8880
textureta.com:2052
textureta.com:2082
textureta.com:2086
textureta.com:2095
textureta.com:443
textureta.com:2053
textureta.com:2083
textureta.com:2087
textureta.com:2096
textureta.com:8443
www.textureta.com:80
www.textureta.com:22
www.textureta.com:8080
www.textureta.com:8880
www.textureta.com:2052
www.textureta.com:2082
www.textureta.com:2086
www.textureta.com:2095
www.textureta.com:443
www.textureta.com:2053
www.textureta.com:2083
www.textureta.com:2087
www.textureta.com:2096
www.textureta.com:8443
remote.textureta.com:80
remote.textureta.com:22
remote.textureta.com:8080
remote.textureta.com:8880
remote.textureta.com:2052
remote.textureta.com:2082
remote.textureta.com:2086
remote.textureta.com:2095
remote.textureta.com:443
remote.textureta.com:2053
remote.textureta.com:2083
remote.textureta.com:2087
remote.textureta.com:2096
remote.textureta.com:8443
locky.textureta.com:80
locky.textureta.com:22
locky.textureta.com:8080
locky.textureta.com:8880
locky.textureta.com:2052
locky.textureta.com:2082
locky.textureta.com:2086
locky.textureta.com:2095
locky.textureta.com:443
locky.textureta.com:2053
locky.textureta.com:2083
locky.textureta.com:2087
locky.textureta.com:2096
locky.textureta.com:8443
qbot.textureta.com:80
qbot.textureta.com:22
qbot.textureta.com:8080
qbot.textureta.com:8880
qbot.textureta.com:2052
qbot.textureta.com:2082
qbot.textureta.com:2086
qbot.textureta.com:2095
qbot.textureta.com:443
qbot.textureta.com:2053
qbot.textureta.com:2083
qbot.textureta.com:2087
qbot.textureta.com:2096
qbot.textureta.com:8443
revil.textureta.com:80
revil.textureta.com:22
revil.textureta.com:8080
revil.textureta.com:8880
revil.textureta.com:2052
revil.textureta.com:2082
revil.textureta.com:2086
revil.textureta.com:2095
revil.textureta.com:443
revil.textureta.com:2053
revil.textureta.com:2083
revil.textureta.com:2087
revil.textureta.com:2096
revil.textureta.com:8443

Mutex

UpLPAP3iQpSo

Attributes

delay
0
install
true
install_file
gzhy8i.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  cbe5162326e561c0120cf8c2b0df45b92596ea1579b40a9787f166a5db6963e8
- Size 45KB
- SHA256 cbe5162326e561c0120cf8c2b0df45b92596ea1579b40a9787f166a5db6963e8
- MD5 5c573c883028e474da1e3aafa1f19c43
- SHA1 5a2b8edfe13429525e15167eed6d6b9b0265a0fe
- SHA512 5283370c2b6496b15d956e3f8d463bf6f3a0bb141494f9771c62ce1f7c4033cde9507131c52a0cf1c8ad7a50d11e344b84e6c9237fb6545b3b6509d4b903924a
- SSDEEP 768:EulCJTHESwgWUK3aGmo2q95dR3aI6OPIuzjbrgI3iQMep12YdbBDZsx:EulCJTHl42mjqb3u3bUISQn3Ndsx
- TLSH
  T15B23190037E8812BF2BE4F789CF26245867AF6673603D58E1CC4519B5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2