Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
shadow.exe
-
Size
45KB
-
Sample
230324-b6d4sabe36
-
MD5
b0c54754039e4c312c81cc1de388e1e6
-
SHA1
c00e8d078f1224156e5f34720732891afe72d654
-
SHA256
aa199fbb289e048c5abaa334be3eb172175cf53e736d3a15ca32549086c99a8c
-
SHA512
c58117d3f377b6b7c1bba94d56049927a2a0e76e4243fa217ed8af1e80365939a5d3441572dea3c079403c07cad36ffebd35703e69fb258518244f2ca25d8bc8
-
SSDEEP
768:DuU2VTwkbBHWU7TZcFmo2qjLKjGKG6PIyzjbFgX3i0ZHPcZekvlaBDZDx:DuU2VTwAJM2aKYDy3bCXS0ZC+dDx
Behavioral task
behavioral1
Sample
shadow.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
klept0wiz-33913.portmap.host:33913
guaeiofj398ajgka340gka9wk3f09jq3ad
-
delay
3
-
install
true
-
install_file
Management.exe
-
install_folder
%AppData%
Targets
-
-
Target
shadow.exe
-
Size
45KB
-
MD5
b0c54754039e4c312c81cc1de388e1e6
-
SHA1
c00e8d078f1224156e5f34720732891afe72d654
-
SHA256
aa199fbb289e048c5abaa334be3eb172175cf53e736d3a15ca32549086c99a8c
-
SHA512
c58117d3f377b6b7c1bba94d56049927a2a0e76e4243fa217ed8af1e80365939a5d3441572dea3c079403c07cad36ffebd35703e69fb258518244f2ca25d8bc8
-
SSDEEP
768:DuU2VTwkbBHWU7TZcFmo2qjLKjGKG6PIyzjbFgX3i0ZHPcZekvlaBDZDx:DuU2VTwAJM2aKYDy3bCXS0ZC+dDx
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-