Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Steam Checker By abbadon.zip

  • Size

    2.8MB

  • Sample

    230101-e4k14aed3t

  • MD5

    80af7d9f004509017d652eb6c0ecabfd

  • SHA1

    7498df9a718060dec8397afe7f2fde4ed7b8b4db

  • SHA256

    1cc12f5a9abb33e222373fa27b4ef631abfbd9343a168b194ef8c958bee79abc

  • SHA512

    8a1756cc2d7d84638f6bea79bf21e5ccd91ac7c6708cddb129c9bf8f21c69be96b265ea94dd9cd8caf64ad65fab4b860aa531c25bbb62e0aa403b44d69804acb

  • SSDEEP

    49152:Dxd90vxd7wLDSjYOzemobbkbzM+xuMduCwLDSjYOz+bkjz8+xuMejvuu:P6DybbkbzM+uMduP6DCbkjz8+uMeDuu

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

C

C2

185.81.157.169:2023

Mutex

7G6ZCBCA-NJ11-YS93-65bg-CX918E7238D5

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Steam Checker By abbadon/BruteEngine.dll

    • Size

      108KB

    • MD5

      317d5deabdb509be15d14fba4e1dc3bc

    • SHA1

      f29453ecd2e5131057f1944b30362493496121c4

    • SHA256

      883198948acf83999374a442451acd6d63b406a2f5e174f10f23fcfc8252da06

    • SHA512

      a9ffdf6e107d3133cd09f6bea5aa927ba83a75f3508dd316150afd9c300a64dda52e3f3d6e08abe8b98e2f88f066714cbfe805dd1b43a28a5bae1a1ce0825afe

    • SSDEEP

      3072:Ht2passJt2H5NV9xKDumCF3wiImNtPzn3q:fssWJ9xK6msb

    Score
    1/10
    • Target

      Steam Checker By abbadon/Bunifu_UI_v1.52.dll

    • Size

      220KB

    • MD5

      3764580d568e4fc506048e04db90562c

    • SHA1

      e8d2771a4891ad7b751c4ac153f599d7d58ebd31

    • SHA256

      27c8cea7e793ace737415881a5c16b4e2d98ce46609d272e82c6c905ad2d9f36

    • SHA512

      fdc11be9388034404c9c71a60374486ff15d552bd8e9f7f74ca345e7d40df20dcb992e6d4e7b509e31e53c910e33ed8e275467da92c30193d6fab16934491763

    • SSDEEP

      3072:UYZOzNgqlPPL42pFzo3tgyGkToR74K5BC6u+QVTNDcHaDDPuD6bl4:UYZYgEr44Fzo3tFIEKiJNDcHKPueb

    Score
    1/10
    • Target

      Steam Checker By abbadon/Login Theme.dll

    • Size

      100KB

    • MD5

      88293398c17eae7abbd9853dd86d5135

    • SHA1

      4a93c4658bb81ac066eaa1c8b33eb1d8658cf46e

    • SHA256

      6179f9c0a09c4ac4747fa59fd5e428c9e1c27203d32397b304ce2c9ac53cfb1b

    • SHA512

      67dd685eab92bb941ec280b218e94c3d09ce265b7b0ea60c64d1e590a59e52b839d972b153c9bfa0bbf62704d6bed7ad0978d7407be62169acec29c1054c32d9

    • SSDEEP

      3072:bSX+m1P60pB9aP1iSXG9eIjeYN+7Mg3+ajYBvZouX4E+up9oqa:idP02b4vc9oq

    Score
    1/10
    • Target

      Steam Checker By abbadon/MaterialSkin.dll

    • Size

      574KB

    • MD5

      dae45e51f8763bd0369a221480db0ee1

    • SHA1

      e52bdbd4e13081a014d03bffaec7d3f0969c8822

    • SHA256

      b9879df15e82c52e9166c71f7b177c57bd4c8289821a65a9d3f5228b3f606b4e

    • SHA512

      660fc090dafd639c57601290be1783a77fc96729bde628a2fb846f2c0a9c8f504f0984c9f6c4b0c4797d29c224320c8fbda0bb09188a10a3170a9e681d91a977

    • SSDEEP

      12288:rkkxswcXKC2zNWfm2YRm5sm2YRm5hkxswcXKC2zNWB:rkZX9uWfm2Yysm2YyhZX9uW

    Score
    1/10
    • Target

      Steam Checker By abbadon/MetroFramework.Design.dll

    • Size

      16KB

    • MD5

      ab4c3529694fc8d2427434825f71b2b8

    • SHA1

      7be378e382e43eae84f1567b3570bca9a67e7697

    • SHA256

      0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65

    • SHA512

      02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5

    • SSDEEP

      384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr

    Score
    1/10
    • Target

      Steam Checker By abbadon/MetroFramework.Fonts.dll

    • Size

      656KB

    • MD5

      65ef4b23060128743cef937a43b82aa3

    • SHA1

      cc72536b84384ec8479b9734b947dce885ef5d31

    • SHA256

      c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26

    • SHA512

      d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7

    • SSDEEP

      12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw

    Score
    1/10
    • Target

      Steam Checker By abbadon/MetroFramework.dll

    • Size

      2KB

    • MD5

      76f317a2b57ea647d044540a8863ce50

    • SHA1

      0b959bdfa96b0210223f4868f5bb230d20fbac71

    • SHA256

      36987386a38df7ca838d6743a3c63a40c5f3c15359bed49e7c27128161b64166

    • SHA512

      43e08bb0455a19e6de82d43e5238be78c91badd507acc00e6467ebf726a6f1ad78496829ad4918cd833626a50227433342ab5193582bc72b414dfa2f7bb277e4

    Score
    1/10
    • Target

      Steam Checker By abbadon/MetroSuite 2.0.dll

    • Size

      305KB

    • MD5

      0d30a398cec0ff006b6ea2b52d11e744

    • SHA1

      4ceebd9c6180a321c4d4f3cfb5cfc3952bf72b45

    • SHA256

      8604bf2a1fe2e94dc1ea1fbd0cf54e77303493b93994df48479dc683580aa654

    • SHA512

      8e06ff131a81e73b1ff5de78262701a11ecc2bcdaf41011f4e96f11c5372742478e70b6a0901b61953c21c95725532af8d785654405ec5066ad157e2143467cc

    • SSDEEP

      3072:K6J2UBugOAI+yjNDWswy1MNo1EvnvkgvloSVQBjDifX0pPSRZ9KZdf8uvqtXfZBF:K6Jr8xhFzfOaa3xqQnQGTO

    Score
    1/10
    • Target

      Steam Checker By abbadon/Newtonsoft.Json.dll

    • Size

      659KB

    • MD5

      4df6c8781e70c3a4912b5be796e6d337

    • SHA1

      cbc510520fcd85dbc1c82b02e82040702aca9b79

    • SHA256

      3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af

    • SHA512

      964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c

    • SSDEEP

      12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn

    Score
    1/10
    • Target

      Steam Checker By abbadon/Steam Checker V0.1 By Abbadon.exe

    • Size

      121KB

    • MD5

      f0bfac0acff34c1e85a1fa3b63c315a6

    • SHA1

      52b9ab7aa6b1836ae278da3575c5c7338f2c43b5

    • SHA256

      2ddc9622baef1953e848b441d949bea26e22097149a44b04f0fa870e334c549a

    • SHA512

      fd4021d4638ffb54afa237b372f92768a105cd1b1fa7a7012ca64e4bfab73c91f826191b9d07aff09bc26f170b1aea673dd9e08be5fb311708177a7ed4a7fdbc

    • SSDEEP

      3072:5bCyJlgzy96ZZZZZZZZZZZZZZZZMZZZZZZZZZZvZZZZZZZZZZZZZZZZZZZZZZZZ+:5bIy9Wq

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    • Target

      Steam Checker By abbadon/SuperEngine.dll

    • Size

      126KB

    • MD5

      1a747b12dc16ac54760ab52c06620edf

    • SHA1

      1d848781c858b6c937773ed37e9e457c29fef233

    • SHA256

      ea7f2057b2a5f65d2b25762ab2bc64c2a3ab106a3ef13b52e504a516a3c21418

    • SHA512

      40bc3a1827277e95832d61ddcd1a92a9c5ecee9bb315a631983812526ba12c9ab2ee3f06f5094155dcf03e76dc32d2334f3f118953a5adaf85ffebea0db07da6

    • SSDEEP

      3072:vRoo8MN8og9TdREdqnV+xnEdVTD+AIE/KkHxpSS4SBi8AsZLnpChqctmWqMcO:5zW9Td+dqnV+xnEdJ+AIES

    Score
    1/10
    • Target

      Steam Checker By abbadon/Teen.dll

    • Size

      44KB

    • MD5

      174120401135403ec305cdea6194fb28

    • SHA1

      3732bd4d3dde4721686412d267167f0701d238c6

    • SHA256

      cf01ca48b705c4af4f410fb4437f374cbae895f07ac163ae1ab0e390fa4b292a

    • SHA512

      016bc5a77c899ea3340f7311d4780c12c444f33918aefefb0069b4b93d41d085283f20bfb203fb401ceaa67ca2c8ad8d4585326dc28d46659ddd02e722c5bc22

    • SSDEEP

      384:T8VonuhLWhSO5p94lUG4YARG4ayzEs9uq0xF60HoVObGKoUjQblRoAcb8tbfGNXk:Y0uLCPPY4a+KqF8GzUKlCZY1a5T2AI

    Score
    1/10
    • Target

      Steam Checker By abbadon/config/Config.bat

    • Size

      264B

    • MD5

      443439b6d74924824b35ee2fe65af7e7

    • SHA1

      c94233394c85c86ea0f1d658a32e5ab27f60730f

    • SHA256

      74d98354b2cf545581931fef42a42e8fc3298b236f6536cc31fa821f31b4e6da

    • SHA512

      98b28b6546e3fd3fbf89895c21ff6b7d93568559433addc4be238825a11445a2496c90a872f10e0b316fdaf07ee0ccbf4054d7c5483456ecbda36154b879f1be

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    • Target

      Steam Checker By abbadon/config/System/C2.ps1

    • Size

      216B

    • MD5

      f686af0c71099697b9e3cdb67dafde71

    • SHA1

      e24acca7145e84c4cb95627d8402895d0cf15dea

    • SHA256

      b64e5111b381cf66fd84aaf59ea503adf737c620ef550363466ce15822f52743

    • SHA512

      b2d90ac3447afbba7b0a6f43584f9d9533b0980dbb74e9d084f108cbcc80c3b299cbf120bfae13c4fbeb952c5208c99a4a08492ac0b732ebe1c1f8dbbbbeb5cc

    Score
    1/10
    • Target

      Steam Checker By abbadon/config/System/CopyTo.PS1

    • Size

      195B

    • MD5

      4cad39a3c49a131b8d172fca8259f2fa

    • SHA1

      940a0789c909d26de9357533bf5dd1ad2db01b4a

    • SHA256

      2273ff44dd60f9ef1a13a1867355b8181c6fbd2b8ef2f8d0ef426538c841dd7e

    • SHA512

      0fb9127f8b0a63d3abb52d83b078aaeaaaf964e897a148ae09bf76c0539633f59dd6c467945fa24c3eb03dbc03a7811387e2e2773a652ed6585f6049c97fb72f

    Score
    1/10
    • Target

      Steam Checker By abbadon/config/System/FrameWork.bat

    • Size

      520B

    • MD5

      e2bbc4167314dc0fc9acba48f2c94b74

    • SHA1

      a6b4a5502f2078353769d9bd22ce632ff9035067

    • SHA256

      20cf5b36516ca5251a79e6dcd08f6f8e6f3696ef24959829bc5a387950b7d178

    • SHA512

      4cc2946ce8ce192b3e7bf1ea51a3305e7656c229ca1c5795c4f3762df0005d7b3db2a4e676c8b9ecbf9d770b6c379a9c15a9f3fa994ca829faea30dd64fece9d

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

    • Async RAT payload

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

Score
N/A

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

asyncratcrat
Score
10/10

behavioral20

asyncratcrat
Score
10/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

asyncratcrat
Score
10/10

behavioral26

asyncratcrat
Score
10/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

asyncratcrat
Score
10/10

behavioral32

asyncratcrat
Score
10/10