General
- Target c4.exe
- Size 48KB
- Sample260724-tn8jsasvas
- SHA256 a36a1de4706be7436988ba9d07e7cf16ef29863f9a6960ad24dd817ccba1dc4d
- MD5 f81f7687aaa3e4353b3e5b0ae142f84c
- SHA1 c1181f13deac7b2283e74170552ce8ee398a226a
- SHA512 0b60100457967e9d375420b0aeecabe95d51bef785ee70b5efd8db7537bd6c9ddbf2612566f3a56ad32dde94e3755cb4ee1479993a857a986b6d2f6fa97ddc59
- SSDEEP 1536:wukedTww12zPMXfob72eQ/KSut773ddIx:wukiTww124Xfob7q/KSutH3dKx
- TLSH T14E233C007BE9816BF2BF4F7899F222458677F2637603D54D2CD4419B0A13FC29A52AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
c4.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
c4.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
tottrot.org/:6606
-
tottrot.org/:80
-
tottrot.org/:8080
-
tottrot.org/:443
-
tottrot.org/:8443
-
tottrot.org/:22
-
tottrot.org/:23
-
apklampung4d.buzz/:6606
-
apklampung4d.buzz/:80
-
apklampung4d.buzz/:8080
-
apklampung4d.buzz/:443
-
apklampung4d.buzz/:8443
-
apklampung4d.buzz/:22
-
apklampung4d.buzz/:23
-
aaalandje.nl/:6606
-
aaalandje.nl/:80
-
aaalandje.nl/:8080
-
aaalandje.nl/:443
-
aaalandje.nl/:8443
-
aaalandje.nl/:22
-
aaalandje.nl/:23
-
www-tg88.com/:6606
-
www-tg88.com/:80
-
www-tg88.com/:8080
-
www-tg88.com/:443
-
www-tg88.com/:8443
-
www-tg88.com/:22
-
www-tg88.com/:23
-
www.hoochiemama.me/:6606
-
www.hoochiemama.me/:80
-
www.hoochiemama.me/:8080
-
www.hoochiemama.me/:443
-
www.hoochiemama.me/:8443
-
www.hoochiemama.me/:22
-
www.hoochiemama.me/:23
-
tg88.br.com/:6606
-
tg88.br.com/:80
-
tg88.br.com/:8080
-
tg88.br.com/:443
-
tg88.br.com/:8443
-
tg88.br.com/:22
-
tg88.br.com/:23
-
tg88y.com/:6606
-
tg88y.com/:80
-
tg88y.com/:8080
-
tg88y.com/:443
-
tg88y.com/:8443
-
tg88y.com/:22
-
tg88y.com/:23
-
tg88.moe/:6606
-
tg88.moe/:80
-
tg88.moe/:8080
-
tg88.moe/:443
-
tg88.moe/:8443
-
tg88.moe/:22
-
tg88.moe/:23
-
tg88.autos/:6606
-
tg88.autos/:80
-
tg88.autos/:8080
-
tg88.autos/:443
-
tg88.autos/:8443
-
tg88.autos/:22
-
tg88.autos/:23
-
tgvips.com/:6606
-
tgvips.com/:80
-
tgvips.com/:8080
-
tgvips.com/:443
-
tgvips.com/:8443
-
tgvips.com/:22
-
tgvips.com/:23
-
tg88-vn.com/:6606
-
tg88-vn.com/:80
-
tg88-vn.com/:8080
-
tg88-vn.com/:443
-
tg88-vn.com/:8443
-
tg88-vn.com/:22
-
tg88-vn.com/:23
-
vntg88play.com/:6606
-
vntg88play.com/:80
-
vntg88play.com/:8080
-
vntg88play.com/:443
-
vntg88play.com/:8443
-
vntg88play.com/:22
-
vntg88play.com/:23
-
tg88appslot.com/:6606
-
tg88appslot.com/:80
-
tg88appslot.com/:8080
-
tg88appslot.com/:443
-
tg88appslot.com/:8443
-
tg88appslot.com/:22
-
tg88appslot.com/:23
-
tg88homevip.com/:6606
-
tg88homevip.com/:80
-
tg88homevip.com/:8080
-
tg88homevip.com/:443
-
tg88homevip.com/:8443
-
tg88homevip.com/:22
-
tg88homevip.com/:23
-
tg88online.com/:6606
-
tg88online.com/:80
-
tg88online.com/:8080
-
tg88online.com/:443
-
tg88online.com/:8443
-
tg88online.com/:22
-
tg88online.com/:23
-
tg88t5.com/:6606
-
tg88t5.com/:80
-
tg88t5.com/:8080
-
tg88t5.com/:443
-
tg88t5.com/:8443
-
tg88t5.com/:22
-
tg88t5.com/:23
-
tg88linkwin.com/:6606
-
tg88linkwin.com/:80
-
tg88linkwin.com/:8080
-
tg88linkwin.com/:443
-
tg88linkwin.com/:8443
-
tg88linkwin.com/:22
-
tg88linkwin.com/:23
-
logintg88.com/:6606
-
logintg88.com/:80
-
logintg88.com/:8080
-
logintg88.com/:443
-
logintg88.com/:8443
-
logintg88.com/:22
-
logintg88.com/:23
-
luxurystudio.com.co/vi-vn/:6606
-
luxurystudio.com.co/vi-vn/:80
-
luxurystudio.com.co/vi-vn/:8080
-
luxurystudio.com.co/vi-vn/:443
-
luxurystudio.com.co/vi-vn/:8443
-
luxurystudio.com.co/vi-vn/:22
-
luxurystudio.com.co/vi-vn/:23
-
playwinner.me/vi-vn/:6606
-
playwinner.me/vi-vn/:80
-
playwinner.me/vi-vn/:8080
-
playwinner.me/vi-vn/:443
-
playwinner.me/vi-vn/:8443
-
playwinner.me/vi-vn/:22
-
playwinner.me/vi-vn/:23
-
sivin.in/vi-vn/:6606
-
sivin.in/vi-vn/:80
-
sivin.in/vi-vn/:8080
-
sivin.in/vi-vn/:443
-
sivin.in/vi-vn/:8443
-
sivin.in/vi-vn/:22
-
sivin.in/vi-vn/:23
-
go8.cx/:6606
-
go8.cx/:80
-
go8.cx/:8080
-
go8.cx/:443
-
go8.cx/:8443
-
go8.cx/:22
-
go8.cx/:23
-
lv88-18.com/vi-vn/:6606
-
lv88-18.com/vi-vn/:80
-
lv88-18.com/vi-vn/:8080
-
lv88-18.com/vi-vn/:443
-
lv88-18.com/vi-vn/:8443
-
lv88-18.com/vi-vn/:22
-
lv88-18.com/vi-vn/:23
-
lv88a.it.com/:6606
-
lv88a.it.com/:80
-
lv88a.it.com/:8080
-
lv88a.it.com/:443
-
lv88a.it.com/:8443
-
lv88a.it.com/:22
-
lv88a.it.com/:23
-
rulertube.fun/vi-vn/:6606
-
rulertube.fun/vi-vn/:80
-
rulertube.fun/vi-vn/:8080
-
rulertube.fun/vi-vn/:443
-
rulertube.fun/vi-vn/:8443
-
rulertube.fun/vi-vn/:22
-
rulertube.fun/vi-vn/:23
-
jw88.org/:6606
-
jw88.org/:80
-
jw88.org/:8080
-
jw88.org/:443
-
jw88.org/:8443
-
jw88.org/:22
-
jw88.org/:23
-
dn8800.com/vi-vn/:6606
-
dn8800.com/vi-vn/:80
-
dn8800.com/vi-vn/:8080
-
dn8800.com/vi-vn/:443
-
dn8800.com/vi-vn/:8443
-
dn8800.com/vi-vn/:22
-
dn8800.com/vi-vn/:23
-
AMAEULL6JnCa
-
delay
3
-
install
true
-
install_file
GoogleUpdate.exe
-
install_folder
%AppData%
Targets
-
- Target c4.exe
- Size 48KB
- SHA256 a36a1de4706be7436988ba9d07e7cf16ef29863f9a6960ad24dd817ccba1dc4d
- MD5 f81f7687aaa3e4353b3e5b0ae142f84c
- SHA1 c1181f13deac7b2283e74170552ce8ee398a226a
- SHA512 0b60100457967e9d375420b0aeecabe95d51bef785ee70b5efd8db7537bd6c9ddbf2612566f3a56ad32dde94e3755cb4ee1479993a857a986b6d2f6fa97ddc59
- SSDEEP 1536:wukedTww12zPMXfob72eQ/KSut773ddIx:wukiTww124Xfob7q/KSutH3dKx
- TLSH T14E233C007BE9816BF2BF4F7899F222458677F2637603D54D2CD4419B0A13FC29A52AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE