General
- Target c289d88d-bd13-40f5-a5fb-e66482da0360.exe
- Size 46KB
- Sample260727-mea4laz1ht
- SHA256 f0570b3730f3436d6ce23e8ab0f21529474bba0a00560df6ba41c0f1a9507b39
- MD5 eac37811a1b6542802998b89e953f691
- SHA1 466166604a8f3d88bb7c3a123863c95d8a428774
- SHA512 6655f13968055e08fc2bdc5d52d1a3c67aa10f674660596ae5783d654a16face0f459b328f3910f29a320e467408b1fe7666ec24be2fd5fe5d6b74c8d4e1fdf6
- SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+x:IaPsRKdsFDHbe4hrtbUzM5b2f+x
- TLSH T180231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
c289d88d-bd13-40f5-a5fb-e66482da0360.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
c289d88d-bd13-40f5-a5fb-e66482da0360.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
388pg88.com:4930
-
388pg88.com:0921
-
388pg88.com:1123
-
388pg88.com:8362
-
388pg88.com:3439
-
388pg88.com:2551
-
388pg88.com:5786
-
388pg88.com:7404
-
388pg88.com:2158
-
388pg88.com:8075
-
www.388pg88.com:4930
-
www.388pg88.com:0921
-
www.388pg88.com:1123
-
www.388pg88.com:8362
-
www.388pg88.com:3439
-
www.388pg88.com:2551
-
www.388pg88.com:5786
-
www.388pg88.com:7404
-
www.388pg88.com:2158
-
www.388pg88.com:8075
-
NotPetya.388pg88.com:4930
-
NotPetya.388pg88.com:0921
-
NotPetya.388pg88.com:1123
-
NotPetya.388pg88.com:8362
-
NotPetya.388pg88.com:3439
-
NotPetya.388pg88.com:2551
-
NotPetya.388pg88.com:5786
-
NotPetya.388pg88.com:7404
-
NotPetya.388pg88.com:2158
-
NotPetya.388pg88.com:8075
-
Stuxnet.388pg88.com:4930
-
Stuxnet.388pg88.com:0921
-
Stuxnet.388pg88.com:1123
-
Stuxnet.388pg88.com:8362
-
Stuxnet.388pg88.com:3439
-
Stuxnet.388pg88.com:2551
-
Stuxnet.388pg88.com:5786
-
Stuxnet.388pg88.com:7404
-
Stuxnet.388pg88.com:2158
-
Stuxnet.388pg88.com:8075
-
Zeus.388pg88.com:4930
-
Zeus.388pg88.com:0921
-
Zeus.388pg88.com:1123
-
Zeus.388pg88.com:8362
-
Zeus.388pg88.com:3439
-
Zeus.388pg88.com:2551
-
Zeus.388pg88.com:5786
-
Zeus.388pg88.com:7404
-
Zeus.388pg88.com:2158
-
Zeus.388pg88.com:8075
-
CryptoLocker.388pg88.com:4930
-
CryptoLocker.388pg88.com:0921
-
CryptoLocker.388pg88.com:1123
-
CryptoLocker.388pg88.com:8362
-
CryptoLocker.388pg88.com:3439
-
CryptoLocker.388pg88.com:2551
-
CryptoLocker.388pg88.com:5786
-
CryptoLocker.388pg88.com:7404
-
CryptoLocker.388pg88.com:2158
-
CryptoLocker.388pg88.com:8075
-
388pg88.com/vi-vn/%3A9292:4930
-
388pg88.com/vi-vn/%3A9292:0921
-
388pg88.com/vi-vn/%3A9292:1123
-
388pg88.com/vi-vn/%3A9292:8362
-
388pg88.com/vi-vn/%3A9292:3439
-
388pg88.com/vi-vn/%3A9292:2551
-
388pg88.com/vi-vn/%3A9292:5786
-
388pg88.com/vi-vn/%3A9292:7404
-
388pg88.com/vi-vn/%3A9292:2158
-
388pg88.com/vi-vn/%3A9292:8075
-
388pg88.com/vi-vn/%3A7106:4930
-
388pg88.com/vi-vn/%3A7106:0921
-
388pg88.com/vi-vn/%3A7106:1123
-
388pg88.com/vi-vn/%3A7106:8362
-
388pg88.com/vi-vn/%3A7106:3439
-
388pg88.com/vi-vn/%3A7106:2551
-
388pg88.com/vi-vn/%3A7106:5786
-
388pg88.com/vi-vn/%3A7106:7404
-
388pg88.com/vi-vn/%3A7106:2158
-
388pg88.com/vi-vn/%3A7106:8075
-
388pg88.com/vi-vn/%3A4251:4930
-
388pg88.com/vi-vn/%3A4251:0921
-
388pg88.com/vi-vn/%3A4251:1123
-
388pg88.com/vi-vn/%3A4251:8362
-
388pg88.com/vi-vn/%3A4251:3439
-
388pg88.com/vi-vn/%3A4251:2551
-
388pg88.com/vi-vn/%3A4251:5786
-
388pg88.com/vi-vn/%3A4251:7404
-
388pg88.com/vi-vn/%3A4251:2158
-
388pg88.com/vi-vn/%3A4251:8075
-
388pg88.com/vi-vn/%3A3841:4930
-
388pg88.com/vi-vn/%3A3841:0921
-
388pg88.com/vi-vn/%3A3841:1123
-
388pg88.com/vi-vn/%3A3841:8362
-
388pg88.com/vi-vn/%3A3841:3439
-
388pg88.com/vi-vn/%3A3841:2551
-
388pg88.com/vi-vn/%3A3841:5786
-
388pg88.com/vi-vn/%3A3841:7404
-
388pg88.com/vi-vn/%3A3841:2158
-
388pg88.com/vi-vn/%3A3841:8075
-
388pg88.com/vi-vn/%3A6657:4930
-
388pg88.com/vi-vn/%3A6657:0921
-
388pg88.com/vi-vn/%3A6657:1123
-
388pg88.com/vi-vn/%3A6657:8362
-
388pg88.com/vi-vn/%3A6657:3439
-
388pg88.com/vi-vn/%3A6657:2551
-
388pg88.com/vi-vn/%3A6657:5786
-
388pg88.com/vi-vn/%3A6657:7404
-
388pg88.com/vi-vn/%3A6657:2158
-
388pg88.com/vi-vn/%3A6657:8075
-
388pg88.com/vi-vn/%3A9669:4930
-
388pg88.com/vi-vn/%3A9669:0921
-
388pg88.com/vi-vn/%3A9669:1123
-
388pg88.com/vi-vn/%3A9669:8362
-
388pg88.com/vi-vn/%3A9669:3439
-
388pg88.com/vi-vn/%3A9669:2551
-
388pg88.com/vi-vn/%3A9669:5786
-
388pg88.com/vi-vn/%3A9669:7404
-
388pg88.com/vi-vn/%3A9669:2158
-
388pg88.com/vi-vn/%3A9669:8075
-
388pg88.com/vi-vn/%3A3665:4930
-
388pg88.com/vi-vn/%3A3665:0921
-
388pg88.com/vi-vn/%3A3665:1123
-
388pg88.com/vi-vn/%3A3665:8362
-
388pg88.com/vi-vn/%3A3665:3439
-
388pg88.com/vi-vn/%3A3665:2551
-
388pg88.com/vi-vn/%3A3665:5786
-
388pg88.com/vi-vn/%3A3665:7404
-
388pg88.com/vi-vn/%3A3665:2158
-
388pg88.com/vi-vn/%3A3665:8075
-
6MOCJMTjUj3O
-
delay
3
-
install
true
-
install_file
pg888.exe
-
install_folder
%AppData%
Targets
-
- Target c289d88d-bd13-40f5-a5fb-e66482da0360.exe
- Size 46KB
- SHA256 f0570b3730f3436d6ce23e8ab0f21529474bba0a00560df6ba41c0f1a9507b39
- MD5 eac37811a1b6542802998b89e953f691
- SHA1 466166604a8f3d88bb7c3a123863c95d8a428774
- SHA512 6655f13968055e08fc2bdc5d52d1a3c67aa10f674660596ae5783d654a16face0f459b328f3910f29a320e467408b1fe7666ec24be2fd5fe5d6b74c8d4e1fdf6
- SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+x:IaPsRKdsFDHbe4hrtbUzM5b2f+x
- TLSH T180231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE