Overview

overview

10

Static

static

10

nhin cai l...ay.exe

windows10-2004-x64

10

nhin cai l...ay.exe

windows10-ltsc_2021-x64

10

nhin cai l...ay.exe

windows11-21h2-x64

10

nhin cai l...ay.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    nhin cai lon ma may.exe
  • Size 46KB
  • Sample261018-rvrhqs1set
  • SHA256 1f076f44f7d11ea9a693d1bda963504afca74873aea879daa74ae1557da79a20
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
asyncratnulldiscoveryrat

Malware Config

Extracted

Family

  • asyncrat

Version

  • 0.5.6A

Botnet

  • null

C2

  • qh88eu.com:8080

  • c2.qh88eu.com:8080

  • api.qh88eu.com:8080

  • malware.qh88eu.com:8080

  • backdoor.qh88eu.com:8080

  • www.qh88eu.com:8080

Mutex

  • NickReport

Attributes
  • delay

    5

  • install

    false

  • install_file

    NickReport.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      nhin cai lon ma may.exe
    • Size 46KB
    • SHA256 1f076f44f7d11ea9a693d1bda963504afca74873aea879daa74ae1557da79a20
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    nulldiscoveryasyncratrat

    • Family: AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks