General
- Target a49c3c2e-655e-4ef7-95b0-19375f137b3e.exe
- Size 46KB
- Sample260727-mebecsad87
- SHA256 30278be3ab6ec6d558f10667fedce44bc8e552ad5f6bfa2a08e5d4826a6716fd
- MD5 4a60b45e1dd287d6f0b9b4d113fc61bd
- SHA1 4ff0ad0a5ab1511fd11fc66fb726df9e29e217f6
- SHA512 e7f92830268d364e5e4f0fee0aca63ebcae7b25fddf2bf775e9cc3ba1bcf11184c0686d125f5875be6922ad9348283d7931407f1f3322d0f88397a7827016425
- SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+X:IaPsRKdsFDHbe4hrtbUzM5b2f+X
- TLSH T144231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
a49c3c2e-655e-4ef7-95b0-19375f137b3e.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
a49c3c2e-655e-4ef7-95b0-19375f137b3e.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
388pg88.com:4930
-
388pg88.com:0921
-
388pg88.com:1123
-
388pg88.com:8362
-
388pg88.com:3439
-
388pg88.com:2551
-
388pg88.com:5786
-
388pg88.com:7404
-
388pg88.com:2158
-
388pg88.com:8075
-
www.388pg88.com:4930
-
www.388pg88.com:0921
-
www.388pg88.com:1123
-
www.388pg88.com:8362
-
www.388pg88.com:3439
-
www.388pg88.com:2551
-
www.388pg88.com:5786
-
www.388pg88.com:7404
-
www.388pg88.com:2158
-
www.388pg88.com:8075
-
NotPetya.388pg88.com:4930
-
NotPetya.388pg88.com:0921
-
NotPetya.388pg88.com:1123
-
NotPetya.388pg88.com:8362
-
NotPetya.388pg88.com:3439
-
NotPetya.388pg88.com:2551
-
NotPetya.388pg88.com:5786
-
NotPetya.388pg88.com:7404
-
NotPetya.388pg88.com:2158
-
NotPetya.388pg88.com:8075
-
Stuxnet.388pg88.com:4930
-
Stuxnet.388pg88.com:0921
-
Stuxnet.388pg88.com:1123
-
Stuxnet.388pg88.com:8362
-
Stuxnet.388pg88.com:3439
-
Stuxnet.388pg88.com:2551
-
Stuxnet.388pg88.com:5786
-
Stuxnet.388pg88.com:7404
-
Stuxnet.388pg88.com:2158
-
Stuxnet.388pg88.com:8075
-
Zeus.388pg88.com:4930
-
Zeus.388pg88.com:0921
-
Zeus.388pg88.com:1123
-
Zeus.388pg88.com:8362
-
Zeus.388pg88.com:3439
-
Zeus.388pg88.com:2551
-
Zeus.388pg88.com:5786
-
Zeus.388pg88.com:7404
-
Zeus.388pg88.com:2158
-
Zeus.388pg88.com:8075
-
CryptoLocker.388pg88.com:4930
-
CryptoLocker.388pg88.com:0921
-
CryptoLocker.388pg88.com:1123
-
CryptoLocker.388pg88.com:8362
-
CryptoLocker.388pg88.com:3439
-
CryptoLocker.388pg88.com:2551
-
CryptoLocker.388pg88.com:5786
-
CryptoLocker.388pg88.com:7404
-
CryptoLocker.388pg88.com:2158
-
CryptoLocker.388pg88.com:8075
-
388pg88.com/vi-vn/%3A9292:4930
-
388pg88.com/vi-vn/%3A9292:0921
-
388pg88.com/vi-vn/%3A9292:1123
-
388pg88.com/vi-vn/%3A9292:8362
-
388pg88.com/vi-vn/%3A9292:3439
-
388pg88.com/vi-vn/%3A9292:2551
-
388pg88.com/vi-vn/%3A9292:5786
-
388pg88.com/vi-vn/%3A9292:7404
-
388pg88.com/vi-vn/%3A9292:2158
-
388pg88.com/vi-vn/%3A9292:8075
-
388pg88.com/vi-vn/%3A7106:4930
-
388pg88.com/vi-vn/%3A7106:0921
-
388pg88.com/vi-vn/%3A7106:1123
-
388pg88.com/vi-vn/%3A7106:8362
-
388pg88.com/vi-vn/%3A7106:3439
-
388pg88.com/vi-vn/%3A7106:2551
-
388pg88.com/vi-vn/%3A7106:5786
-
388pg88.com/vi-vn/%3A7106:7404
-
388pg88.com/vi-vn/%3A7106:2158
-
388pg88.com/vi-vn/%3A7106:8075
-
388pg88.com/vi-vn/%3A4251:4930
-
388pg88.com/vi-vn/%3A4251:0921
-
388pg88.com/vi-vn/%3A4251:1123
-
388pg88.com/vi-vn/%3A4251:8362
-
388pg88.com/vi-vn/%3A4251:3439
-
388pg88.com/vi-vn/%3A4251:2551
-
388pg88.com/vi-vn/%3A4251:5786
-
388pg88.com/vi-vn/%3A4251:7404
-
388pg88.com/vi-vn/%3A4251:2158
-
388pg88.com/vi-vn/%3A4251:8075
-
388pg88.com/vi-vn/%3A3841:4930
-
388pg88.com/vi-vn/%3A3841:0921
-
388pg88.com/vi-vn/%3A3841:1123
-
388pg88.com/vi-vn/%3A3841:8362
-
388pg88.com/vi-vn/%3A3841:3439
-
388pg88.com/vi-vn/%3A3841:2551
-
388pg88.com/vi-vn/%3A3841:5786
-
388pg88.com/vi-vn/%3A3841:7404
-
388pg88.com/vi-vn/%3A3841:2158
-
388pg88.com/vi-vn/%3A3841:8075
-
388pg88.com/vi-vn/%3A6657:4930
-
388pg88.com/vi-vn/%3A6657:0921
-
388pg88.com/vi-vn/%3A6657:1123
-
388pg88.com/vi-vn/%3A6657:8362
-
388pg88.com/vi-vn/%3A6657:3439
-
388pg88.com/vi-vn/%3A6657:2551
-
388pg88.com/vi-vn/%3A6657:5786
-
388pg88.com/vi-vn/%3A6657:7404
-
388pg88.com/vi-vn/%3A6657:2158
-
388pg88.com/vi-vn/%3A6657:8075
-
388pg88.com/vi-vn/%3A9669:4930
-
388pg88.com/vi-vn/%3A9669:0921
-
388pg88.com/vi-vn/%3A9669:1123
-
388pg88.com/vi-vn/%3A9669:8362
-
388pg88.com/vi-vn/%3A9669:3439
-
388pg88.com/vi-vn/%3A9669:2551
-
388pg88.com/vi-vn/%3A9669:5786
-
388pg88.com/vi-vn/%3A9669:7404
-
388pg88.com/vi-vn/%3A9669:2158
-
388pg88.com/vi-vn/%3A9669:8075
-
388pg88.com/vi-vn/%3A3665:4930
-
388pg88.com/vi-vn/%3A3665:0921
-
388pg88.com/vi-vn/%3A3665:1123
-
388pg88.com/vi-vn/%3A3665:8362
-
388pg88.com/vi-vn/%3A3665:3439
-
388pg88.com/vi-vn/%3A3665:2551
-
388pg88.com/vi-vn/%3A3665:5786
-
388pg88.com/vi-vn/%3A3665:7404
-
388pg88.com/vi-vn/%3A3665:2158
-
388pg88.com/vi-vn/%3A3665:8075
-
6MOCJMTjUj3O
-
delay
3
-
install
true
-
install_file
pg888.exe
-
install_folder
%AppData%
Targets
-
- Target a49c3c2e-655e-4ef7-95b0-19375f137b3e.exe
- Size 46KB
- SHA256 30278be3ab6ec6d558f10667fedce44bc8e552ad5f6bfa2a08e5d4826a6716fd
- MD5 4a60b45e1dd287d6f0b9b4d113fc61bd
- SHA1 4ff0ad0a5ab1511fd11fc66fb726df9e29e217f6
- SHA512 e7f92830268d364e5e4f0fee0aca63ebcae7b25fddf2bf775e9cc3ba1bcf11184c0686d125f5875be6922ad9348283d7931407f1f3322d0f88397a7827016425
- SSDEEP 768:IaPs6mLzaGjxvdwFGJx8OxBzJKHG1PDAIjbRg47FrEcVbUBfUmM5b2f+X:IaPsRKdsFDHbe4hrtbUzM5b2f+X
- TLSH T144231B043BECC227F2BE4F7899F2624586B6F6532603DA491CC812D65613FC5DE426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE