General
- Target Muco.exe
- Size 49KB
- Sample260831-jgwarser9w
- SHA256 7b24fb576ef05d59cfa5680c3a2554b4fcb5052eb06394b649cdea1be9b59a35
- MD5 2d90cdf61e09fb2a3421154e5d493af7
- SHA1 98c9c41340d18f366dd563d2c832632f266aa971
- SHA512 0b72677f8ab437dab83ad9ae180716416862788822faa7027f00fdb9fcabb1b3b00e4a1077c9c0335b1ede6cc6b046da0aecce9ab7afdc8c1fd97e753ae34446
- SSDEEP 1536:1uH2NTIDr2MTddy9VvYbaZR+RE/eM2d/x:1uHqTIDr2gXy9VvYbaZRYEmRNx
- TLSH T1C0332B003BE9812AF2BE5F7899F27145867BF5733602D55E1CC4029B5623FC29A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
Muco.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Muco.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Extracted
-
asyncrat
-
0.5.8
-
Default
-
789win.com.mx/vi-vn/:80
-
789win.com.mx/vi-vn/:8080
-
789win.com.mx/vi-vn/:443
-
789win.com.mx/vi-vn/:8443
-
789win.com.mx/vi-vn/:22
-
789win.com.mx/vi-vn/:23
-
789win.com.mx/vi-vn/:6606
-
789win.com.mx/vi-vn/:5555
-
789win29.autos/vi-vn/:80
-
789win29.autos/vi-vn/:8080
-
789win29.autos/vi-vn/:443
-
789win29.autos/vi-vn/:8443
-
789win29.autos/vi-vn/:22
-
789win29.autos/vi-vn/:23
-
789win29.autos/vi-vn/:6606
-
789win29.autos/vi-vn/:5555
-
789win123.com/vi-vn/:80
-
789win123.com/vi-vn/:8080
-
789win123.com/vi-vn/:443
-
789win123.com/vi-vn/:8443
-
789win123.com/vi-vn/:22
-
789win123.com/vi-vn/:23
-
789win123.com/vi-vn/:6606
-
789win123.com/vi-vn/:5555
-
fairtex.my/vi-vn/:80
-
fairtex.my/vi-vn/:8080
-
fairtex.my/vi-vn/:443
-
fairtex.my/vi-vn/:8443
-
fairtex.my/vi-vn/:22
-
fairtex.my/vi-vn/:23
-
fairtex.my/vi-vn/:6606
-
fairtex.my/vi-vn/:5555
-
789wint.dev/vi-vn/:80
-
789wint.dev/vi-vn/:8080
-
789wint.dev/vi-vn/:443
-
789wint.dev/vi-vn/:8443
-
789wint.dev/vi-vn/:22
-
789wint.dev/vi-vn/:23
-
789wint.dev/vi-vn/:6606
-
789wint.dev/vi-vn/:5555
-
xovr.me/vi-vn/:80
-
xovr.me/vi-vn/:8080
-
xovr.me/vi-vn/:443
-
xovr.me/vi-vn/:8443
-
xovr.me/vi-vn/:22
-
xovr.me/vi-vn/:23
-
xovr.me/vi-vn/:6606
-
xovr.me/vi-vn/:5555
-
jokerslotvava.vip/vi-vn/:80
-
jokerslotvava.vip/vi-vn/:8080
-
jokerslotvava.vip/vi-vn/:443
-
jokerslotvava.vip/vi-vn/:8443
-
jokerslotvava.vip/vi-vn/:22
-
jokerslotvava.vip/vi-vn/:23
-
jokerslotvava.vip/vi-vn/:6606
-
jokerslotvava.vip/vi-vn/:5555
-
apcore.pl/vi-vn/:80
-
apcore.pl/vi-vn/:8080
-
apcore.pl/vi-vn/:443
-
apcore.pl/vi-vn/:8443
-
apcore.pl/vi-vn/:22
-
apcore.pl/vi-vn/:23
-
apcore.pl/vi-vn/:6606
-
apcore.pl/vi-vn/:5555
-
98wins.co.com/:80
-
98wins.co.com/:8080
-
98wins.co.com/:443
-
98wins.co.com/:8443
-
98wins.co.com/:22
-
98wins.co.com/:23
-
98wins.co.com/:6606
-
98wins.co.com/:5555
-
98winapp.org/vi-vn/:80
-
98winapp.org/vi-vn/:8080
-
98winapp.org/vi-vn/:443
-
98winapp.org/vi-vn/:8443
-
98winapp.org/vi-vn/:22
-
98winapp.org/vi-vn/:23
-
98winapp.org/vi-vn/:6606
-
98winapp.org/vi-vn/:5555
-
98win.tel/vi-vn/:80
-
98win.tel/vi-vn/:8080
-
98win.tel/vi-vn/:443
-
98win.tel/vi-vn/:8443
-
98win.tel/vi-vn/:22
-
98win.tel/vi-vn/:23
-
98win.tel/vi-vn/:6606
-
98win.tel/vi-vn/:5555
-
98win.betsoftcasino.co/vi-vn/:80
-
98win.betsoftcasino.co/vi-vn/:8080
-
98win.betsoftcasino.co/vi-vn/:443
-
98win.betsoftcasino.co/vi-vn/:8443
-
98win.betsoftcasino.co/vi-vn/:22
-
98win.betsoftcasino.co/vi-vn/:23
-
98win.betsoftcasino.co/vi-vn/:6606
-
98win.betsoftcasino.co/vi-vn/:5555
-
uu88.co.nl/vi-vn/:80
-
uu88.co.nl/vi-vn/:8080
-
uu88.co.nl/vi-vn/:443
-
uu88.co.nl/vi-vn/:8443
-
uu88.co.nl/vi-vn/:22
-
uu88.co.nl/vi-vn/:23
-
uu88.co.nl/vi-vn/:6606
-
uu88.co.nl/vi-vn/:5555
-
wmpro.cc/vi-vn/:80
-
wmpro.cc/vi-vn/:8080
-
wmpro.cc/vi-vn/:443
-
wmpro.cc/vi-vn/:8443
-
wmpro.cc/vi-vn/:22
-
wmpro.cc/vi-vn/:23
-
wmpro.cc/vi-vn/:6606
-
wmpro.cc/vi-vn/:5555
-
super789slot.co/vi-vn/:80
-
super789slot.co/vi-vn/:8080
-
super789slot.co/vi-vn/:443
-
super789slot.co/vi-vn/:8443
-
super789slot.co/vi-vn/:22
-
super789slot.co/vi-vn/:23
-
super789slot.co/vi-vn/:6606
-
super789slot.co/vi-vn/:5555
-
xn--bnkerslot-01a.co/vi-vn/:80
-
xn--bnkerslot-01a.co/vi-vn/:8080
-
xn--bnkerslot-01a.co/vi-vn/:443
-
xn--bnkerslot-01a.co/vi-vn/:8443
-
xn--bnkerslot-01a.co/vi-vn/:22
-
xn--bnkerslot-01a.co/vi-vn/:23
-
xn--bnkerslot-01a.co/vi-vn/:6606
-
xn--bnkerslot-01a.co/vi-vn/:5555
-
sapphireeightythree.in/vi-vn/:80
-
sapphireeightythree.in/vi-vn/:8080
-
sapphireeightythree.in/vi-vn/:443
-
sapphireeightythree.in/vi-vn/:8443
-
sapphireeightythree.in/vi-vn/:22
-
sapphireeightythree.in/vi-vn/:23
-
sapphireeightythree.in/vi-vn/:6606
-
sapphireeightythree.in/vi-vn/:5555
-
tuyulslotgacor.cc/vi-vn/:80
-
tuyulslotgacor.cc/vi-vn/:8080
-
tuyulslotgacor.cc/vi-vn/:443
-
tuyulslotgacor.cc/vi-vn/:8443
-
tuyulslotgacor.cc/vi-vn/:22
-
tuyulslotgacor.cc/vi-vn/:23
-
tuyulslotgacor.cc/vi-vn/:6606
-
tuyulslotgacor.cc/vi-vn/:5555
-
kopi88slot.co/vi-vn/:80
-
kopi88slot.co/vi-vn/:8080
-
kopi88slot.co/vi-vn/:443
-
kopi88slot.co/vi-vn/:8443
-
kopi88slot.co/vi-vn/:22
-
kopi88slot.co/vi-vn/:23
-
kopi88slot.co/vi-vn/:6606
-
kopi88slot.co/vi-vn/:5555
-
adik4dslot.com/vn/:80
-
adik4dslot.com/vn/:8080
-
adik4dslot.com/vn/:443
-
adik4dslot.com/vn/:8443
-
adik4dslot.com/vn/:22
-
adik4dslot.com/vn/:23
-
adik4dslot.com/vn/:6606
-
adik4dslot.com/vn/:5555
-
navnit.co.in/vi-vn/:80
-
navnit.co.in/vi-vn/:8080
-
navnit.co.in/vi-vn/:443
-
navnit.co.in/vi-vn/:8443
-
navnit.co.in/vi-vn/:22
-
navnit.co.in/vi-vn/:23
-
navnit.co.in/vi-vn/:6606
-
navnit.co.in/vi-vn/:5555
-
dn88.jp.net/:80
-
dn88.jp.net/:8080
-
dn88.jp.net/:443
-
dn88.jp.net/:8443
-
dn88.jp.net/:22
-
dn88.jp.net/:23
-
dn88.jp.net/:6606
-
dn88.jp.net/:5555
-
okcasino99.co/vi-vn/:80
-
okcasino99.co/vi-vn/:8080
-
okcasino99.co/vi-vn/:443
-
okcasino99.co/vi-vn/:8443
-
okcasino99.co/vi-vn/:22
-
okcasino99.co/vi-vn/:23
-
okcasino99.co/vi-vn/:6606
-
okcasino99.co/vi-vn/:5555
-
pokerpulsa.co/vi-vn/:80
-
pokerpulsa.co/vi-vn/:8080
-
pokerpulsa.co/vi-vn/:443
-
pokerpulsa.co/vi-vn/:8443
-
pokerpulsa.co/vi-vn/:22
-
pokerpulsa.co/vi-vn/:23
-
pokerpulsa.co/vi-vn/:6606
-
pokerpulsa.co/vi-vn/:5555
-
arnature.in/vi-vn/:80
-
arnature.in/vi-vn/:8080
-
arnature.in/vi-vn/:443
-
arnature.in/vi-vn/:8443
-
arnature.in/vi-vn/:22
-
arnature.in/vi-vn/:23
-
arnature.in/vi-vn/:6606
-
arnature.in/vi-vn/:5555
-
www.five88.jp.net/:80
-
www.five88.jp.net/:8080
-
www.five88.jp.net/:443
-
www.five88.jp.net/:8443
-
www.five88.jp.net/:22
-
www.five88.jp.net/:23
-
www.five88.jp.net/:6606
-
www.five88.jp.net/:5555
-
feedis.io/vi-vn/:80
-
feedis.io/vi-vn/:8080
-
feedis.io/vi-vn/:443
-
feedis.io/vi-vn/:8443
-
feedis.io/vi-vn/:22
-
feedis.io/vi-vn/:23
-
feedis.io/vi-vn/:6606
-
feedis.io/vi-vn/:5555
-
five88.voto/:80
-
five88.voto/:8080
-
five88.voto/:443
-
five88.voto/:8443
-
five88.voto/:22
-
five88.voto/:23
-
five88.voto/:6606
-
five88.voto/:5555
-
pgking888th.com/vi-vn/:80
-
pgking888th.com/vi-vn/:8080
-
pgking888th.com/vi-vn/:443
-
pgking888th.com/vi-vn/:8443
-
pgking888th.com/vi-vn/:22
-
pgking888th.com/vi-vn/:23
-
pgking888th.com/vi-vn/:6606
-
pgking888th.com/vi-vn/:5555
-
etdev.me/vi-vn/:80
-
etdev.me/vi-vn/:8080
-
etdev.me/vi-vn/:443
-
etdev.me/vi-vn/:8443
-
etdev.me/vi-vn/:22
-
etdev.me/vi-vn/:23
-
etdev.me/vi-vn/:6606
-
etdev.me/vi-vn/:5555
-
raovathot.net/vi-vn/:80
-
raovathot.net/vi-vn/:8080
-
raovathot.net/vi-vn/:443
-
raovathot.net/vi-vn/:8443
-
raovathot.net/vi-vn/:22
-
raovathot.net/vi-vn/:23
-
raovathot.net/vi-vn/:6606
-
raovathot.net/vi-vn/:5555
-
98win98.mex.com/:80
-
98win98.mex.com/:8080
-
98win98.mex.com/:443
-
98win98.mex.com/:8443
-
98win98.mex.com/:22
-
98win98.mex.com/:23
-
98win98.mex.com/:6606
-
98win98.mex.com/:5555
-
batikslots.co/vi-vn/:80
-
batikslots.co/vi-vn/:8080
-
batikslots.co/vi-vn/:443
-
batikslots.co/vi-vn/:8443
-
batikslots.co/vi-vn/:22
-
batikslots.co/vi-vn/:23
-
batikslots.co/vi-vn/:6606
-
batikslots.co/vi-vn/:5555
-
B8yCkl7Vhrcz
-
delay
3
-
install
true
-
install_file
GoogleUpdate.exe
-
install_folder
%AppData%
Targets
-
- Target Muco.exe
- Size 49KB
- SHA256 7b24fb576ef05d59cfa5680c3a2554b4fcb5052eb06394b649cdea1be9b59a35
- MD5 2d90cdf61e09fb2a3421154e5d493af7
- SHA1 98c9c41340d18f366dd563d2c832632f266aa971
- SHA512 0b72677f8ab437dab83ad9ae180716416862788822faa7027f00fdb9fcabb1b3b00e4a1077c9c0335b1ede6cc6b046da0aecce9ab7afdc8c1fd97e753ae34446
- SSDEEP 1536:1uH2NTIDr2MTddy9VvYbaZR+RE/eM2d/x:1uHqTIDr2gXy9VvYbaZRYEmRNx
- TLSH T1C0332B003BE9812AF2BE5F7899F27145867BF5733602D55E1CC4029B5623FC29A426FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE