asyncrat | 36b1faf1b0d6a8e24a24cd0d856af5fd4b5168baabc372199ff151cdec398cd9

Sharing

Copy URL Twitter E-mail

General

Target
36b1faf1b0d6a8e24a24cd0d856af5fd4b5168baabc372199ff151cdec398cd9
Size 45KB
Sample260701-xsheyaex61
SHA256 36b1faf1b0d6a8e24a24cd0d856af5fd4b5168baabc372199ff151cdec398cd9
MD5 2d1afe0f465174e1f65a1ae5503cc2a4
SHA1 5372f06207ac33405e73b5a522ceafad4e2c258e
SHA512 5934bfd247cd49bcafb6da5d81196300c4aa7842f755d5fa7e0a720f96b432e697d7df5feef5792aaed81e2c01066d010cc331d16ff4c305c087031f31775d4b
SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFylsHoPEaMPIG/jbMgX3ipW7xBv2oBDZEx:MuLAZTnbg2XuuEaxGLbDXSpW7xBvFdEx
TLSH
T1BC232B003BD8816BF2BE4B78ACF26145467EF6636603D54D1CC411DB5713BC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

textureta.com:80
textureta.com:22
textureta.com:8080
textureta.com:8880
textureta.com:2052
textureta.com:2082
textureta.com:2086
textureta.com:2095
textureta.com:443
textureta.com:2053
textureta.com:2083
textureta.com:2087
textureta.com:2096
textureta.com:8443
www.textureta.com:80
www.textureta.com:22
www.textureta.com:8080
www.textureta.com:8880
www.textureta.com:2052
www.textureta.com:2082
www.textureta.com:2086
www.textureta.com:2095
www.textureta.com:443
www.textureta.com:2053
www.textureta.com:2083
www.textureta.com:2087
www.textureta.com:2096
www.textureta.com:8443
nanocore.textureta.com:80
nanocore.textureta.com:22
nanocore.textureta.com:8080
nanocore.textureta.com:8880
nanocore.textureta.com:2052
nanocore.textureta.com:2082
nanocore.textureta.com:2086
nanocore.textureta.com:2095
nanocore.textureta.com:443
nanocore.textureta.com:2053
nanocore.textureta.com:2083
nanocore.textureta.com:2087
nanocore.textureta.com:2096
nanocore.textureta.com:8443
invasive.textureta.com:80
invasive.textureta.com:22
invasive.textureta.com:8080
invasive.textureta.com:8880
invasive.textureta.com:2052
invasive.textureta.com:2082
invasive.textureta.com:2086
invasive.textureta.com:2095
invasive.textureta.com:443
invasive.textureta.com:2053
invasive.textureta.com:2083
invasive.textureta.com:2087
invasive.textureta.com:2096
invasive.textureta.com:8443
blaster.textureta.com:80
blaster.textureta.com:22
blaster.textureta.com:8080
blaster.textureta.com:8880
blaster.textureta.com:2052
blaster.textureta.com:2082
blaster.textureta.com:2086
blaster.textureta.com:2095
blaster.textureta.com:443
blaster.textureta.com:2053
blaster.textureta.com:2083
blaster.textureta.com:2087
blaster.textureta.com:2096
blaster.textureta.com:8443

Mutex

2bq7aMWD3VKh

Attributes

delay
0
install
true
install_file
cp0dc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  36b1faf1b0d6a8e24a24cd0d856af5fd4b5168baabc372199ff151cdec398cd9
- Size 45KB
- SHA256 36b1faf1b0d6a8e24a24cd0d856af5fd4b5168baabc372199ff151cdec398cd9
- MD5 2d1afe0f465174e1f65a1ae5503cc2a4
- SHA1 5372f06207ac33405e73b5a522ceafad4e2c258e
- SHA512 5934bfd247cd49bcafb6da5d81196300c4aa7842f755d5fa7e0a720f96b432e697d7df5feef5792aaed81e2c01066d010cc331d16ff4c305c087031f31775d4b
- SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFylsHoPEaMPIG/jbMgX3ipW7xBv2oBDZEx:MuLAZTnbg2XuuEaxGLbDXSpW7xBvFdEx
- TLSH
  T1BC232B003BD8816BF2BE4B78ACF26145467EF6636603D54D1CC411DB5713BC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2