asyncrat | 49ff2bf60a9dd0ce2ca0825243c099938a92e41795739fb10590089d66daabb6

Sharing

Copy URL Twitter E-mail

General

Target
49ff2bf60a9dd0ce2ca0825243c099938a92e41795739fb10590089d66daabb6
Size 45KB
Sample260702-lbcycafs8y
SHA256 49ff2bf60a9dd0ce2ca0825243c099938a92e41795739fb10590089d66daabb6
MD5 478123129b952eae927d567fdd06523a
SHA1 8168edd51882450dfbee0b4713752f326fd75778
SHA512 b97a6e5d169752d2e6a2ebabf62d0bf117d8d13a18853597d914009cdd7ba3002ae6278f1cbccb34b5b84695fd273295ba70d7a221aec39cac201e68d128f5a0
SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAeb30GYjHuPI8zjbggXfi0561oXBw9MdBDZcx:UuKWgSJTwRf2uw/383bHXa2wwdcx
TLSH
T185232B003BE9812BF2BE4FB899F26105467AF6636603D6491CC452DB5713FC6CA426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

textureta.com:80
textureta.com:22
textureta.com:8080
textureta.com:8880
textureta.com:2052
textureta.com:2082
textureta.com:2086
textureta.com:2095
textureta.com:443
textureta.com:2053
textureta.com:2083
textureta.com:2087
textureta.com:2096
textureta.com:8443
www.textureta.com:80
www.textureta.com:22
www.textureta.com:8080
www.textureta.com:8880
www.textureta.com:2052
www.textureta.com:2082
www.textureta.com:2086
www.textureta.com:2095
www.textureta.com:443
www.textureta.com:2053
www.textureta.com:2083
www.textureta.com:2087
www.textureta.com:2096
www.textureta.com:8443
ryuk.textureta.com:80
ryuk.textureta.com:22
ryuk.textureta.com:8080
ryuk.textureta.com:8880
ryuk.textureta.com:2052
ryuk.textureta.com:2082
ryuk.textureta.com:2086
ryuk.textureta.com:2095
ryuk.textureta.com:443
ryuk.textureta.com:2053
ryuk.textureta.com:2083
ryuk.textureta.com:2087
ryuk.textureta.com:2096
ryuk.textureta.com:8443
sodinokibi.textureta.com:80
sodinokibi.textureta.com:22
sodinokibi.textureta.com:8080
sodinokibi.textureta.com:8880
sodinokibi.textureta.com:2052
sodinokibi.textureta.com:2082
sodinokibi.textureta.com:2086
sodinokibi.textureta.com:2095
sodinokibi.textureta.com:443
sodinokibi.textureta.com:2053
sodinokibi.textureta.com:2083
sodinokibi.textureta.com:2087
sodinokibi.textureta.com:2096
sodinokibi.textureta.com:8443
connect.textureta.com:80
connect.textureta.com:22
connect.textureta.com:8080
connect.textureta.com:8880
connect.textureta.com:2052
connect.textureta.com:2082
connect.textureta.com:2086
connect.textureta.com:2095
connect.textureta.com:443
connect.textureta.com:2053
connect.textureta.com:2083
connect.textureta.com:2087
connect.textureta.com:2096
connect.textureta.com:8443
hermeticwiper.textureta.com:80
hermeticwiper.textureta.com:22
hermeticwiper.textureta.com:8080
hermeticwiper.textureta.com:8880
hermeticwiper.textureta.com:2052
hermeticwiper.textureta.com:2082
hermeticwiper.textureta.com:2086
hermeticwiper.textureta.com:2095
hermeticwiper.textureta.com:443
hermeticwiper.textureta.com:2053
hermeticwiper.textureta.com:2083
hermeticwiper.textureta.com:2087
hermeticwiper.textureta.com:2096
hermeticwiper.textureta.com:8443

Mutex

4tKfN1GDHpFm

Attributes

delay
0
install
true
install_file
zlvl2sbo.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  49ff2bf60a9dd0ce2ca0825243c099938a92e41795739fb10590089d66daabb6
- Size 45KB
- SHA256 49ff2bf60a9dd0ce2ca0825243c099938a92e41795739fb10590089d66daabb6
- MD5 478123129b952eae927d567fdd06523a
- SHA1 8168edd51882450dfbee0b4713752f326fd75778
- SHA512 b97a6e5d169752d2e6a2ebabf62d0bf117d8d13a18853597d914009cdd7ba3002ae6278f1cbccb34b5b84695fd273295ba70d7a221aec39cac201e68d128f5a0
- SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAeb30GYjHuPI8zjbggXfi0561oXBw9MdBDZcx:UuKWgSJTwRf2uw/383bHXa2wwdcx
- TLSH
  T185232B003BE9812BF2BE4FB899F26105467AF6636603D6491CC452DB5713FC6CA426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2