asyncrat | afd8fbe7cf03fc5fd4a3bdf9e80345a2a3c8948f4737b091c2d3080b9e557355

Sharing

Copy URL Twitter E-mail

General

Target
afd8fbe7cf03fc5fd4a3bdf9e80345a2a3c8948f4737b091c2d3080b9e557355
Size 45KB
Sample260701-s3k7csbt2t
SHA256 afd8fbe7cf03fc5fd4a3bdf9e80345a2a3c8948f4737b091c2d3080b9e557355
MD5 c91e2a8796f4e172d9541a94b88f4226
SHA1 ac9885ef1b1936285f6d203a64a5ff1e4ed4372d
SHA512 1ce2f0da668af392a61db33205521c7102335bf1f324190ff58792b09f03baab47659196f0a774ec9e9ef80135a9fe4b17150f71a35d86ba173728bfab1e98cf
SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5o5TN8/nPI6EzjbxgX3iBtcaFapY6BDZMx:ku40ZTXEb2TeEoTNKA6E3b+XSPcaFamH
TLSH
T1FD231B003BE8812BF2BF4F7899F261458A7AF5633603D94A1CC451DB5713BC68A526FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

textureta.com:80
textureta.com:22
textureta.com:8080
textureta.com:8880
textureta.com:2052
textureta.com:2082
textureta.com:2086
textureta.com:2095
textureta.com:443
textureta.com:2053
textureta.com:2083
textureta.com:2087
textureta.com:2096
textureta.com:8443
www.textureta.com:80
www.textureta.com:22
www.textureta.com:8080
www.textureta.com:8880
www.textureta.com:2052
www.textureta.com:2082
www.textureta.com:2086
www.textureta.com:2095
www.textureta.com:443
www.textureta.com:2053
www.textureta.com:2083
www.textureta.com:2087
www.textureta.com:2096
www.textureta.com:8443
nanocore.textureta.com:80
nanocore.textureta.com:22
nanocore.textureta.com:8080
nanocore.textureta.com:8880
nanocore.textureta.com:2052
nanocore.textureta.com:2082
nanocore.textureta.com:2086
nanocore.textureta.com:2095
nanocore.textureta.com:443
nanocore.textureta.com:2053
nanocore.textureta.com:2083
nanocore.textureta.com:2087
nanocore.textureta.com:2096
nanocore.textureta.com:8443
malware.textureta.com:80
malware.textureta.com:22
malware.textureta.com:8080
malware.textureta.com:8880
malware.textureta.com:2052
malware.textureta.com:2082
malware.textureta.com:2086
malware.textureta.com:2095
malware.textureta.com:443
malware.textureta.com:2053
malware.textureta.com:2083
malware.textureta.com:2087
malware.textureta.com:2096
malware.textureta.com:8443
fakeupdates.textureta.com:80
fakeupdates.textureta.com:22
fakeupdates.textureta.com:8080
fakeupdates.textureta.com:8880
fakeupdates.textureta.com:2052
fakeupdates.textureta.com:2082
fakeupdates.textureta.com:2086
fakeupdates.textureta.com:2095
fakeupdates.textureta.com:443
fakeupdates.textureta.com:2053
fakeupdates.textureta.com:2083
fakeupdates.textureta.com:2087
fakeupdates.textureta.com:2096
fakeupdates.textureta.com:8443
ryuk.textureta.com:80
ryuk.textureta.com:22
ryuk.textureta.com:8080
ryuk.textureta.com:8880
ryuk.textureta.com:2052
ryuk.textureta.com:2082
ryuk.textureta.com:2086
ryuk.textureta.com:2095
ryuk.textureta.com:443
ryuk.textureta.com:2053
ryuk.textureta.com:2083
ryuk.textureta.com:2087
ryuk.textureta.com:2096
ryuk.textureta.com:8443

Mutex

5OJJzOwYxLnM

Attributes

delay
0
install
true
install_file
yzh9u.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  afd8fbe7cf03fc5fd4a3bdf9e80345a2a3c8948f4737b091c2d3080b9e557355
- Size 45KB
- SHA256 afd8fbe7cf03fc5fd4a3bdf9e80345a2a3c8948f4737b091c2d3080b9e557355
- MD5 c91e2a8796f4e172d9541a94b88f4226
- SHA1 ac9885ef1b1936285f6d203a64a5ff1e4ed4372d
- SHA512 1ce2f0da668af392a61db33205521c7102335bf1f324190ff58792b09f03baab47659196f0a774ec9e9ef80135a9fe4b17150f71a35d86ba173728bfab1e98cf
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwGeeXK5o5TN8/nPI6EzjbxgX3iBtcaFapY6BDZMx:ku40ZTXEb2TeEoTNKA6E3b+XSPcaFamH
- TLSH
  T1FD231B003BE8812BF2BF4F7899F261458A7AF5633603D94A1CC451DB5713BC68A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2