Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
IMG-2983562837502856238572 IMPORTANTE CONFIRMACION DE TRANSFERENCIA 27 DE SEPTIEMBRE DEL 2022.exe
-
Size
1.1MB
-
Sample
220928-ms5v5affc8
-
MD5
63027acdb2e94bb2898f500e0cab0096
-
SHA1
9cbfef38ce9f29573fa2ef3ef1b9ae1f48d86744
-
SHA256
c9735d5cb6d553dbedcc04e9026961432607e01074aaa863cbd8e576760453cd
-
SHA512
2dd3bab440c80bff02a831cb055666066dd6ae359554a81f6a72293d6b9d6fd06747e3325d0f03faffa78d9ebee769472c558f670ef8492348ed4446eb473ba3
-
SSDEEP
24576:Yg5q8YY6KYuTZkpQpZzY9x9Pnnl6PVoPnP2IRfVYhsgWsa:v5j6UlvZzcx9Pl6PonPchhWz
Static task
static1
Behavioral task
behavioral1
Sample
IMG-2983562837502856238572 IMPORTANTE CONFIRMACION DE TRANSFERENCIA 27 DE SEPTIEMBRE DEL 2022.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
IMG-2983562837502856238572 IMPORTANTE CONFIRMACION DE TRANSFERENCIA 27 DE SEPTIEMBRE DEL 2022.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
asyncrat
1.0.7
Default
mauriciocarrascallora09.duckdns.org:1994
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
IMG-2983562837502856238572 IMPORTANTE CONFIRMACION DE TRANSFERENCIA 27 DE SEPTIEMBRE DEL 2022.exe
-
Size
1.1MB
-
MD5
63027acdb2e94bb2898f500e0cab0096
-
SHA1
9cbfef38ce9f29573fa2ef3ef1b9ae1f48d86744
-
SHA256
c9735d5cb6d553dbedcc04e9026961432607e01074aaa863cbd8e576760453cd
-
SHA512
2dd3bab440c80bff02a831cb055666066dd6ae359554a81f6a72293d6b9d6fd06747e3325d0f03faffa78d9ebee769472c558f670ef8492348ed4446eb473ba3
-
SSDEEP
24576:Yg5q8YY6KYuTZkpQpZzY9x9Pnnl6PVoPnP2IRfVYhsgWsa:v5j6UlvZzcx9Pl6PonPchhWz
Score10/10-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-