General
- Target 7m.exe
- Size 46KB
- Sample260807-wl38dsal91
- SHA256 a902d8279c823fd6e5288e33f3d33c179472b7fb6a9065acc1184a614cfcd06e
- MD5 ee339ffbbf05d2c33d22abbcaa5ef02c
- SHA1 6512f2de75a3d57794a5733ff05cfeed880ad217
- SHA512 6b3212d4a07ad704356b923377c6a0a4b4a3d43183f84aa3190539ce2ed55d9708cd3e9f37dddb5817d68a7c2e69d0294e0f22a82f7ce14b1a25c3529592cdcb
- SSDEEP 768:GuQHFTEzw3pDWUvdCUZmo2qTWR04mmVtbbba7m/RPIWzjbAgH3i4vEWGR4mUlV9y:GuQHFTEo8A2bRJ/q70OW3bnHS4vKRNUI
- TLSH T10D232B003BE8C22BF2BF5F7899F262468A7AF2632603D55A1CC451975713FC29A425FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
7m.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
7m.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
webtest.com.mx:80
-
webtest.com.mx:8080
-
webtest.com.mx:443
-
webtest.com.mx:8443
-
webtest.com.mx:3306
-
webtest.com.mx:20
-
webtest.com.mx:25
-
webtest.com.mx:22
-
lonecesitoahora.com.co:80
-
lonecesitoahora.com.co:8080
-
lonecesitoahora.com.co:443
-
lonecesitoahora.com.co:8443
-
lonecesitoahora.com.co:3306
-
lonecesitoahora.com.co:20
-
lonecesitoahora.com.co:25
-
lonecesitoahora.com.co:22
-
shortylinks.io:80
-
shortylinks.io:8080
-
shortylinks.io:443
-
shortylinks.io:8443
-
shortylinks.io:3306
-
shortylinks.io:20
-
shortylinks.io:25
-
shortylinks.io:22
-
mtly.io:80
-
mtly.io:8080
-
mtly.io:443
-
mtly.io:8443
-
mtly.io:3306
-
mtly.io:20
-
mtly.io:25
-
mtly.io:22
-
empeliculados.co:80
-
empeliculados.co:8080
-
empeliculados.co:443
-
empeliculados.co:8443
-
empeliculados.co:3306
-
empeliculados.co:20
-
empeliculados.co:25
-
empeliculados.co:22
-
7mvn.app:80
-
7mvn.app:8080
-
7mvn.app:443
-
7mvn.app:8443
-
7mvn.app:3306
-
7mvn.app:20
-
7mvn.app:25
-
7mvn.app:22
-
sportstoto.nl:80
-
sportstoto.nl:8080
-
sportstoto.nl:443
-
sportstoto.nl:8443
-
sportstoto.nl:3306
-
sportstoto.nl:20
-
sportstoto.nl:25
-
sportstoto.nl:22
-
tyso7m.top:80
-
tyso7m.top:8080
-
tyso7m.top:443
-
tyso7m.top:8443
-
tyso7m.top:3306
-
tyso7m.top:20
-
tyso7m.top:25
-
tyso7m.top:22
-
ursproject.io:80
-
ursproject.io:8080
-
ursproject.io:443
-
ursproject.io:8443
-
ursproject.io:3306
-
ursproject.io:20
-
ursproject.io:25
-
ursproject.io:22
-
upgradetv.tv:80
-
upgradetv.tv:8080
-
upgradetv.tv:443
-
upgradetv.tv:8443
-
upgradetv.tv:3306
-
upgradetv.tv:20
-
upgradetv.tv:25
-
upgradetv.tv:22
-
webbsc.at:80
-
webbsc.at:8080
-
webbsc.at:443
-
webbsc.at:8443
-
webbsc.at:3306
-
webbsc.at:20
-
webbsc.at:25
-
webbsc.at:22
-
https://webtest.com.mx/:80
-
https://webtest.com.mx/:8080
-
https://webtest.com.mx/:443
-
https://webtest.com.mx/:8443
-
https://webtest.com.mx/:3306
-
https://webtest.com.mx/:20
-
https://webtest.com.mx/:25
-
https://webtest.com.mx/:22
-
https://lonecesitoahora.com.co/:80
-
https://lonecesitoahora.com.co/:8080
-
https://lonecesitoahora.com.co/:443
-
https://lonecesitoahora.com.co/:8443
-
https://lonecesitoahora.com.co/:3306
-
https://lonecesitoahora.com.co/:20
-
https://lonecesitoahora.com.co/:25
-
https://lonecesitoahora.com.co/:22
-
https://shortylinks.io/:80
-
https://shortylinks.io/:8080
-
https://shortylinks.io/:443
-
https://shortylinks.io/:8443
-
https://shortylinks.io/:3306
-
https://shortylinks.io/:20
-
https://shortylinks.io/:25
-
https://shortylinks.io/:22
-
https://mtly.io/:80
-
https://mtly.io/:8080
-
https://mtly.io/:443
-
https://mtly.io/:8443
-
https://mtly.io/:3306
-
https://mtly.io/:20
-
https://mtly.io/:25
-
https://mtly.io/:22
-
https://empeliculados.co/:80
-
https://empeliculados.co/:8080
-
https://empeliculados.co/:443
-
https://empeliculados.co/:8443
-
https://empeliculados.co/:3306
-
https://empeliculados.co/:20
-
https://empeliculados.co/:25
-
https://empeliculados.co/:22
-
https://7mvn.app/:80
-
https://7mvn.app/:8080
-
https://7mvn.app/:443
-
https://7mvn.app/:8443
-
https://7mvn.app/:3306
-
https://7mvn.app/:20
-
https://7mvn.app/:25
-
https://7mvn.app/:22
-
https://sportstoto.nl/:80
-
https://sportstoto.nl/:8080
-
https://sportstoto.nl/:443
-
https://sportstoto.nl/:8443
-
https://sportstoto.nl/:3306
-
https://sportstoto.nl/:20
-
https://sportstoto.nl/:25
-
https://sportstoto.nl/:22
-
https://tyso7m.top/:80
-
https://tyso7m.top/:8080
-
https://tyso7m.top/:443
-
https://tyso7m.top/:8443
-
https://tyso7m.top/:3306
-
https://tyso7m.top/:20
-
https://tyso7m.top/:25
-
https://tyso7m.top/:22
-
https://ursproject.io/:80
-
https://ursproject.io/:8080
-
https://ursproject.io/:443
-
https://ursproject.io/:8443
-
https://ursproject.io/:3306
-
https://ursproject.io/:20
-
https://ursproject.io/:25
-
https://ursproject.io/:22
-
https://upgradetv.tv/:80
-
https://upgradetv.tv/:8080
-
https://upgradetv.tv/:443
-
https://upgradetv.tv/:8443
-
https://upgradetv.tv/:3306
-
https://upgradetv.tv/:20
-
https://upgradetv.tv/:25
-
https://upgradetv.tv/:22
-
https://webbsc.at/:80
-
https://webbsc.at/:8080
-
https://webbsc.at/:443
-
https://webbsc.at/:8443
-
https://webbsc.at/:3306
-
https://webbsc.at/:20
-
https://webbsc.at/:25
-
https://webbsc.at/:22
-
r6wRJGhUWAzg
-
delay
3
-
install
true
-
install_file
7m.exe
-
install_folder
%AppData%
Targets
-
- Target 7m.exe
- Size 46KB
- SHA256 a902d8279c823fd6e5288e33f3d33c179472b7fb6a9065acc1184a614cfcd06e
- MD5 ee339ffbbf05d2c33d22abbcaa5ef02c
- SHA1 6512f2de75a3d57794a5733ff05cfeed880ad217
- SHA512 6b3212d4a07ad704356b923377c6a0a4b4a3d43183f84aa3190539ce2ed55d9708cd3e9f37dddb5817d68a7c2e69d0294e0f22a82f7ce14b1a25c3529592cdcb
- SSDEEP 768:GuQHFTEzw3pDWUvdCUZmo2qTWR04mmVtbbba7m/RPIWzjbAgH3i4vEWGR4mUlV9y:GuQHFTEo8A2bRJ/q70OW3bnHS4vKRNUI
- TLSH T10D232B003BE8C22BF2BF5F7899F262468A7AF2632603D55A1CC451975713FC29A425FD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE