General
- Target no2.exe
- Size 46KB
- Sample260814-d9v8ksfa43
- SHA256 05dd48eefc7f1bdb95bd1bbc1ddd24c70d8c69b93743268fd9a236f8b2930b1d
- MD5 34e65ed8ea76e279fef4893e4373bf8b
- SHA1 51b80acfc41fc59b29723a949004959d458f660c
- SHA512 674a7621d7d42182fe8035af79c57e88b363a903fc219fdd602a9521cafa1e87aebf75d34cd3bcdd52e26db3d3331152f16f8a6c63d9c17a694aa975e017c4d3
- SSDEEP 768:UuYBgT4sfQwWU6BLGmo2q7EROGJAMGIHPI7zjbxgX3iMqX8+EnVowunnXTnBDZ0x:UuYBgT4472PQxp73b+XSlEowmnjBd0x
- TLSH T1AB231A003BE9812AF1BE4F786DF2514586BBF2636603D54E2CC442DB5613FC69642AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
no2.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
no2.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
fun79z.com/:80
-
fun79z.com/:8080
-
fun79z.com/:443
-
fun79z.com/:8443
-
fun79z.com/:6606
-
fun79z.com/:22
-
restoresolutions.in/vi-vn/:80
-
restoresolutions.in/vi-vn/:8080
-
restoresolutions.in/vi-vn/:443
-
restoresolutions.in/vi-vn/:8443
-
restoresolutions.in/vi-vn/:6606
-
restoresolutions.in/vi-vn/:22
-
fun79.mex.com/:80
-
fun79.mex.com/:8080
-
fun79.mex.com/:443
-
fun79.mex.com/:8443
-
fun79.mex.com/:6606
-
fun79.mex.com/:22
-
789winii.com/:80
-
789winii.com/:8080
-
789winii.com/:443
-
789winii.com/:8443
-
789winii.com/:6606
-
789winii.com/:22
-
789win.just200.in/:80
-
789win.just200.in/:8080
-
789win.just200.in/:443
-
789win.just200.in/:8443
-
789win.just200.in/:6606
-
789win.just200.in/:22
-
just200.in/:80
-
just200.in/:8080
-
just200.in/:443
-
just200.in/:8443
-
just200.in/:6606
-
just200.in/:22
-
flyis.me/vi-vn/:80
-
flyis.me/vi-vn/:8080
-
flyis.me/vi-vn/:443
-
flyis.me/vi-vn/:8443
-
flyis.me/vi-vn/:6606
-
flyis.me/vi-vn/:22
-
789win1a.wiki/vi-vn/:80
-
789win1a.wiki/vi-vn/:8080
-
789win1a.wiki/vi-vn/:443
-
789win1a.wiki/vi-vn/:8443
-
789win1a.wiki/vi-vn/:6606
-
789win1a.wiki/vi-vn/:22
-
789wwin.xyz/:80
-
789wwin.xyz/:8080
-
789wwin.xyz/:443
-
789wwin.xyz/:8443
-
789wwin.xyz/:6606
-
789wwin.xyz/:22
-
nbroadcast.in/vi-vn/:80
-
nbroadcast.in/vi-vn/:8080
-
nbroadcast.in/vi-vn/:443
-
nbroadcast.in/vi-vn/:8443
-
nbroadcast.in/vi-vn/:6606
-
nbroadcast.in/vi-vn/:22
-
situsbandarq.poker/vi-vn/:80
-
situsbandarq.poker/vi-vn/:8080
-
situsbandarq.poker/vi-vn/:443
-
situsbandarq.poker/vi-vn/:8443
-
situsbandarq.poker/vi-vn/:6606
-
situsbandarq.poker/vi-vn/:22
-
789winn.it.com/:80
-
789winn.it.com/:8080
-
789winn.it.com/:443
-
789winn.it.com/:8443
-
789winn.it.com/:6606
-
789winn.it.com/:22
-
megaslototo.me/:80
-
megaslototo.me/:8080
-
megaslototo.me/:443
-
megaslototo.me/:8443
-
megaslototo.me/:6606
-
megaslototo.me/:22
-
789wincom.art/:80
-
789wincom.art/:8080
-
789wincom.art/:443
-
789wincom.art/:8443
-
789wincom.art/:6606
-
789wincom.art/:22
-
seriesdroid.pw/vi-vn/:80
-
seriesdroid.pw/vi-vn/:8080
-
seriesdroid.pw/vi-vn/:443
-
seriesdroid.pw/vi-vn/:8443
-
seriesdroid.pw/vi-vn/:6606
-
seriesdroid.pw/vi-vn/:22
-
789winn.click/:80
-
789winn.click/:8080
-
789winn.click/:443
-
789winn.click/:8443
-
789winn.click/:6606
-
789winn.click/:22
-
cuisine-salledebain-var.com/vi-vn/:80
-
cuisine-salledebain-var.com/vi-vn/:8080
-
cuisine-salledebain-var.com/vi-vn/:443
-
cuisine-salledebain-var.com/vi-vn/:8443
-
cuisine-salledebain-var.com/vi-vn/:6606
-
cuisine-salledebain-var.com/vi-vn/:22
-
nk88t6.red/:80
-
nk88t6.red/:8080
-
nk88t6.red/:443
-
nk88t6.red/:8443
-
nk88t6.red/:6606
-
nk88t6.red/:22
-
vividpixelstudio.co/vi-vn/:80
-
vividpixelstudio.co/vi-vn/:8080
-
vividpixelstudio.co/vi-vn/:443
-
vividpixelstudio.co/vi-vn/:8443
-
vividpixelstudio.co/vi-vn/:6606
-
vividpixelstudio.co/vi-vn/:22
-
overtibe.co/vi-vn/:80
-
overtibe.co/vi-vn/:8080
-
overtibe.co/vi-vn/:443
-
overtibe.co/vi-vn/:8443
-
overtibe.co/vi-vn/:6606
-
overtibe.co/vi-vn/:22
-
grandluckp88.me/vi-vn/:80
-
grandluckp88.me/vi-vn/:8080
-
grandluckp88.me/vi-vn/:443
-
grandluckp88.me/vi-vn/:8443
-
grandluckp88.me/vi-vn/:6606
-
grandluckp88.me/vi-vn/:22
-
tallermacias.com.mx/vi-vn/:80
-
tallermacias.com.mx/vi-vn/:8080
-
tallermacias.com.mx/vi-vn/:443
-
tallermacias.com.mx/vi-vn/:8443
-
tallermacias.com.mx/vi-vn/:6606
-
tallermacias.com.mx/vi-vn/:22
-
dn88t5.com/:80
-
dn88t5.com/:8080
-
dn88t5.com/:443
-
dn88t5.com/:8443
-
dn88t5.com/:6606
-
dn88t5.com/:22
-
pgsslotgame.world/vi-vn/:80
-
pgsslotgame.world/vi-vn/:8080
-
pgsslotgame.world/vi-vn/:443
-
pgsslotgame.world/vi-vn/:8443
-
pgsslotgame.world/vi-vn/:6606
-
pgsslotgame.world/vi-vn/:22
-
dn88.buzz/:80
-
dn88.buzz/:8080
-
dn88.buzz/:443
-
dn88.buzz/:8443
-
dn88.buzz/:6606
-
dn88.buzz/:22
-
riobet22.buzz/vi-vn/:80
-
riobet22.buzz/vi-vn/:8080
-
riobet22.buzz/vi-vn/:443
-
riobet22.buzz/vi-vn/:8443
-
riobet22.buzz/vi-vn/:6606
-
riobet22.buzz/vi-vn/:22
-
pokeridn88.info/vi-vn/:80
-
pokeridn88.info/vi-vn/:8080
-
pokeridn88.info/vi-vn/:443
-
pokeridn88.info/vi-vn/:8443
-
pokeridn88.info/vi-vn/:6606
-
pokeridn88.info/vi-vn/:22
-
dn88.golg/:80
-
dn88.golg/:8080
-
dn88.golg/:443
-
dn88.golg/:8443
-
dn88.golg/:6606
-
dn88.golg/:22
-
efast.in/:80
-
efast.in/:8080
-
efast.in/:443
-
efast.in/:8443
-
efast.in/:6606
-
efast.in/:22
-
airmax2018.in.net/vi-vn/:80
-
airmax2018.in.net/vi-vn/:8080
-
airmax2018.in.net/vi-vn/:443
-
airmax2018.in.net/vi-vn/:8443
-
airmax2018.in.net/vi-vn/:6606
-
airmax2018.in.net/vi-vn/:22
-
dRKtPXH3OyA5
-
delay
3
-
install
true
-
install_file
GoogleUpdate.exe
-
install_folder
%AppData%
Targets
-
- Target no2.exe
- Size 46KB
- SHA256 05dd48eefc7f1bdb95bd1bbc1ddd24c70d8c69b93743268fd9a236f8b2930b1d
- MD5 34e65ed8ea76e279fef4893e4373bf8b
- SHA1 51b80acfc41fc59b29723a949004959d458f660c
- SHA512 674a7621d7d42182fe8035af79c57e88b363a903fc219fdd602a9521cafa1e87aebf75d34cd3bcdd52e26db3d3331152f16f8a6c63d9c17a694aa975e017c4d3
- SSDEEP 768:UuYBgT4sfQwWU6BLGmo2q7EROGJAMGIHPI7zjbxgX3iMqX8+EnVowunnXTnBDZ0x:UuYBgT4472PQxp73b+XSlEowmnjBd0x
- TLSH T1AB231A003BE9812AF1BE4F786DF2514586BBF2636603D54E2CC442DB5613FC69642AFA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE