General
- Target db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe
- Size 46KB
- Sample260727-meastsad86
- SHA256 a2c0ed93760054ea0dc0718e8ace4c75ec08542bab565ec7038986416749f478
- MD5 7f43ff258c0a52d58f9eeeb9ba08a9ef
- SHA1 1788069c8e7869e3d4692ef2af7f80a7f7a67da7
- SHA512 744b2b7a54b7677a2b2485d9912b640da064af125a41ae5ec973c967b26dd1fb8d6c4bdf40ae4f15e370b3f8026f557ed26d077827f6bed7fc4e3a3c245220dd
- SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+l:IaPsRKdsFDHbe4hrtbUzM5b2f+l
- TLSH T113231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
388pg88.com:4930
-
388pg88.com:0921
-
388pg88.com:1123
-
388pg88.com:8362
-
388pg88.com:3439
-
388pg88.com:2551
-
388pg88.com:5786
-
388pg88.com:7404
-
388pg88.com:2158
-
388pg88.com:8075
-
www.388pg88.com:4930
-
www.388pg88.com:0921
-
www.388pg88.com:1123
-
www.388pg88.com:8362
-
www.388pg88.com:3439
-
www.388pg88.com:2551
-
www.388pg88.com:5786
-
www.388pg88.com:7404
-
www.388pg88.com:2158
-
www.388pg88.com:8075
-
NotPetya.388pg88.com:4930
-
NotPetya.388pg88.com:0921
-
NotPetya.388pg88.com:1123
-
NotPetya.388pg88.com:8362
-
NotPetya.388pg88.com:3439
-
NotPetya.388pg88.com:2551
-
NotPetya.388pg88.com:5786
-
NotPetya.388pg88.com:7404
-
NotPetya.388pg88.com:2158
-
NotPetya.388pg88.com:8075
-
Stuxnet.388pg88.com:4930
-
Stuxnet.388pg88.com:0921
-
Stuxnet.388pg88.com:1123
-
Stuxnet.388pg88.com:8362
-
Stuxnet.388pg88.com:3439
-
Stuxnet.388pg88.com:2551
-
Stuxnet.388pg88.com:5786
-
Stuxnet.388pg88.com:7404
-
Stuxnet.388pg88.com:2158
-
Stuxnet.388pg88.com:8075
-
Zeus.388pg88.com:4930
-
Zeus.388pg88.com:0921
-
Zeus.388pg88.com:1123
-
Zeus.388pg88.com:8362
-
Zeus.388pg88.com:3439
-
Zeus.388pg88.com:2551
-
Zeus.388pg88.com:5786
-
Zeus.388pg88.com:7404
-
Zeus.388pg88.com:2158
-
Zeus.388pg88.com:8075
-
CryptoLocker.388pg88.com:4930
-
CryptoLocker.388pg88.com:0921
-
CryptoLocker.388pg88.com:1123
-
CryptoLocker.388pg88.com:8362
-
CryptoLocker.388pg88.com:3439
-
CryptoLocker.388pg88.com:2551
-
CryptoLocker.388pg88.com:5786
-
CryptoLocker.388pg88.com:7404
-
CryptoLocker.388pg88.com:2158
-
CryptoLocker.388pg88.com:8075
-
388pg88.com/vi-vn/%3A9292:4930
-
388pg88.com/vi-vn/%3A9292:0921
-
388pg88.com/vi-vn/%3A9292:1123
-
388pg88.com/vi-vn/%3A9292:8362
-
388pg88.com/vi-vn/%3A9292:3439
-
388pg88.com/vi-vn/%3A9292:2551
-
388pg88.com/vi-vn/%3A9292:5786
-
388pg88.com/vi-vn/%3A9292:7404
-
388pg88.com/vi-vn/%3A9292:2158
-
388pg88.com/vi-vn/%3A9292:8075
-
388pg88.com/vi-vn/%3A7106:4930
-
388pg88.com/vi-vn/%3A7106:0921
-
388pg88.com/vi-vn/%3A7106:1123
-
388pg88.com/vi-vn/%3A7106:8362
-
388pg88.com/vi-vn/%3A7106:3439
-
388pg88.com/vi-vn/%3A7106:2551
-
388pg88.com/vi-vn/%3A7106:5786
-
388pg88.com/vi-vn/%3A7106:7404
-
388pg88.com/vi-vn/%3A7106:2158
-
388pg88.com/vi-vn/%3A7106:8075
-
388pg88.com/vi-vn/%3A4251:4930
-
388pg88.com/vi-vn/%3A4251:0921
-
388pg88.com/vi-vn/%3A4251:1123
-
388pg88.com/vi-vn/%3A4251:8362
-
388pg88.com/vi-vn/%3A4251:3439
-
388pg88.com/vi-vn/%3A4251:2551
-
388pg88.com/vi-vn/%3A4251:5786
-
388pg88.com/vi-vn/%3A4251:7404
-
388pg88.com/vi-vn/%3A4251:2158
-
388pg88.com/vi-vn/%3A4251:8075
-
388pg88.com/vi-vn/%3A3841:4930
-
388pg88.com/vi-vn/%3A3841:0921
-
388pg88.com/vi-vn/%3A3841:1123
-
388pg88.com/vi-vn/%3A3841:8362
-
388pg88.com/vi-vn/%3A3841:3439
-
388pg88.com/vi-vn/%3A3841:2551
-
388pg88.com/vi-vn/%3A3841:5786
-
388pg88.com/vi-vn/%3A3841:7404
-
388pg88.com/vi-vn/%3A3841:2158
-
388pg88.com/vi-vn/%3A3841:8075
-
388pg88.com/vi-vn/%3A6657:4930
-
388pg88.com/vi-vn/%3A6657:0921
-
388pg88.com/vi-vn/%3A6657:1123
-
388pg88.com/vi-vn/%3A6657:8362
-
388pg88.com/vi-vn/%3A6657:3439
-
388pg88.com/vi-vn/%3A6657:2551
-
388pg88.com/vi-vn/%3A6657:5786
-
388pg88.com/vi-vn/%3A6657:7404
-
388pg88.com/vi-vn/%3A6657:2158
-
388pg88.com/vi-vn/%3A6657:8075
-
388pg88.com/vi-vn/%3A9669:4930
-
388pg88.com/vi-vn/%3A9669:0921
-
388pg88.com/vi-vn/%3A9669:1123
-
388pg88.com/vi-vn/%3A9669:8362
-
388pg88.com/vi-vn/%3A9669:3439
-
388pg88.com/vi-vn/%3A9669:2551
-
388pg88.com/vi-vn/%3A9669:5786
-
388pg88.com/vi-vn/%3A9669:7404
-
388pg88.com/vi-vn/%3A9669:2158
-
388pg88.com/vi-vn/%3A9669:8075
-
388pg88.com/vi-vn/%3A3665:4930
-
388pg88.com/vi-vn/%3A3665:0921
-
388pg88.com/vi-vn/%3A3665:1123
-
388pg88.com/vi-vn/%3A3665:8362
-
388pg88.com/vi-vn/%3A3665:3439
-
388pg88.com/vi-vn/%3A3665:2551
-
388pg88.com/vi-vn/%3A3665:5786
-
388pg88.com/vi-vn/%3A3665:7404
-
388pg88.com/vi-vn/%3A3665:2158
-
388pg88.com/vi-vn/%3A3665:8075
-
6MOCJMTjUj3O
-
delay
3
-
install
true
-
install_file
pg888.exe
-
install_folder
%AppData%
Targets
-
- Target db8a7113-f8ee-4de2-8eeb-1a4985654e47.exe
- Size 46KB
- SHA256 a2c0ed93760054ea0dc0718e8ace4c75ec08542bab565ec7038986416749f478
- MD5 7f43ff258c0a52d58f9eeeb9ba08a9ef
- SHA1 1788069c8e7869e3d4692ef2af7f80a7f7a67da7
- SHA512 744b2b7a54b7677a2b2485d9912b640da064af125a41ae5ec973c967b26dd1fb8d6c4bdf40ae4f15e370b3f8026f557ed26d077827f6bed7fc4e3a3c245220dd
- SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+l:IaPsRKdsFDHbe4hrtbUzM5b2f+l
- TLSH T113231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE