General
- Target 6a1345906d21d15eb8ea3350b61a4f484475971119044c1dcd42f2e7f1ff6589
- Size 45KB
- Sample260718-v59c3sb17v
- SHA256 6a1345906d21d15eb8ea3350b61a4f484475971119044c1dcd42f2e7f1ff6589
- MD5 627a247a8019a74af2114fc5443dc215
- SHA1 fd8f05bb82a64ee805ac1601c3627f916f0060cf
- SHA512 02290ba686df9acd92ecd9052cddb8eb136f579bbe4930aca1d0dfb14e9caf72041fe44af620bf400d2feb85cbd40c71e13517f9e38188ff652bb30be0dbe73e
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwY7lt440WMOPI0szjbAgXnitycOqrHiHLRB4tBDZMx:ku40ZTXEb24gUM30s3bnXioqrH0BWdMx
- TLSH T16D232A003BE8C12BF2BE4F78ACF26145867AF5633603D58A1CC451DB5613BC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
6a1345906d21d15eb8ea3350b61a4f484475971119044c1dcd42f2e7f1ff6589.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
6a1345906d21d15eb8ea3350b61a4f484475971119044c1dcd42f2e7f1ff6589.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
chichgai.one:80
-
chichgai.one:22
-
chichgai.one:8080
-
chichgai.one:8880
-
chichgai.one:2052
-
chichgai.one:2082
-
chichgai.one:2086
-
chichgai.one:2095
-
chichgai.one:443
-
chichgai.one:2053
-
chichgai.one:2083
-
chichgai.one:2087
-
chichgai.one:2096
-
chichgai.one:8443
-
www.chichgai.one:80
-
www.chichgai.one:22
-
www.chichgai.one:8080
-
www.chichgai.one:8880
-
www.chichgai.one:2052
-
www.chichgai.one:2082
-
www.chichgai.one:2086
-
www.chichgai.one:2095
-
www.chichgai.one:443
-
www.chichgai.one:2053
-
www.chichgai.one:2083
-
www.chichgai.one:2087
-
www.chichgai.one:2096
-
www.chichgai.one:8443
-
industroyer.chichgai.one:80
-
industroyer.chichgai.one:22
-
industroyer.chichgai.one:8080
-
industroyer.chichgai.one:8880
-
industroyer.chichgai.one:2052
-
industroyer.chichgai.one:2082
-
industroyer.chichgai.one:2086
-
industroyer.chichgai.one:2095
-
industroyer.chichgai.one:443
-
industroyer.chichgai.one:2053
-
industroyer.chichgai.one:2083
-
industroyer.chichgai.one:2087
-
industroyer.chichgai.one:2096
-
industroyer.chichgai.one:8443
-
malware.chichgai.one:80
-
malware.chichgai.one:22
-
malware.chichgai.one:8080
-
malware.chichgai.one:8880
-
malware.chichgai.one:2052
-
malware.chichgai.one:2082
-
malware.chichgai.one:2086
-
malware.chichgai.one:2095
-
malware.chichgai.one:443
-
malware.chichgai.one:2053
-
malware.chichgai.one:2083
-
malware.chichgai.one:2087
-
malware.chichgai.one:2096
-
malware.chichgai.one:8443
-
blacklotus.chichgai.one:80
-
blacklotus.chichgai.one:22
-
blacklotus.chichgai.one:8080
-
blacklotus.chichgai.one:8880
-
blacklotus.chichgai.one:2052
-
blacklotus.chichgai.one:2082
-
blacklotus.chichgai.one:2086
-
blacklotus.chichgai.one:2095
-
blacklotus.chichgai.one:443
-
blacklotus.chichgai.one:2053
-
blacklotus.chichgai.one:2083
-
blacklotus.chichgai.one:2087
-
blacklotus.chichgai.one:2096
-
blacklotus.chichgai.one:8443
-
emotet.chichgai.one:80
-
emotet.chichgai.one:22
-
emotet.chichgai.one:8080
-
emotet.chichgai.one:8880
-
emotet.chichgai.one:2052
-
emotet.chichgai.one:2082
-
emotet.chichgai.one:2086
-
emotet.chichgai.one:2095
-
emotet.chichgai.one:443
-
emotet.chichgai.one:2053
-
emotet.chichgai.one:2083
-
emotet.chichgai.one:2087
-
emotet.chichgai.one:2096
-
emotet.chichgai.one:8443
-
buXQ9HvRgUd3
-
delay
0
-
install
true
-
install_file
o18zn.exe
-
install_folder
%AppData%
Targets
-
- Target 6a1345906d21d15eb8ea3350b61a4f484475971119044c1dcd42f2e7f1ff6589
- Size 45KB
- SHA256 6a1345906d21d15eb8ea3350b61a4f484475971119044c1dcd42f2e7f1ff6589
- MD5 627a247a8019a74af2114fc5443dc215
- SHA1 fd8f05bb82a64ee805ac1601c3627f916f0060cf
- SHA512 02290ba686df9acd92ecd9052cddb8eb136f579bbe4930aca1d0dfb14e9caf72041fe44af620bf400d2feb85cbd40c71e13517f9e38188ff652bb30be0dbe73e
- SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwY7lt440WMOPI0szjbAgXnitycOqrHiHLRB4tBDZMx:ku40ZTXEb24gUM30s3bnXioqrH0BWdMx
- TLSH T16D232A003BE8C12BF2BE4F78ACF26145867AF5633603D58A1CC451DB5613BC69A526FE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE