Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3b7f9dcb3b83acf40f32d5f7c500fefb.bin
-
Size
22KB
-
Sample
230330-blk2lacb31
-
MD5
fca085e34dd25c6d91838565985f41d7
-
SHA1
36201681899b0072363635820b64de51b85da481
-
SHA256
2930da605db0ec3fcc6ddfe2b54808fdc417ccedfe1faa9dc3c1d2c69d401a0b
-
SHA512
e6dfd69154d6eae91f6cf393123b519fc6048d52073950fcc15a6c69263ec6976ce3f32e53eba0a2c9fa22c6a2a47367c1dde55e4dcbf57b79a3136713adf2e6
-
SSDEEP
384:cWyT8/xDOurpvpURtb8ydWgEJBSY+mT2Qcj80Hbo+Pt9cgRE6IPDEFpbLNzF:c9oxDO8pvpktb8ydWgr4cC+kgRBIPDEP
Behavioral task
behavioral1
Sample
0c6b9d6c37b17c04112ce5b33b8b7770c483cb70b1e28f66d06d1bbf8384c777.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Christ2
dlusercontent.net:4444
3048tui grwj0grw08
-
delay
3
-
install
true
-
install_file
windllx.exe
-
install_folder
%AppData%
Targets
-
-
Target
0c6b9d6c37b17c04112ce5b33b8b7770c483cb70b1e28f66d06d1bbf8384c777.exe
-
Size
45KB
-
MD5
3b7f9dcb3b83acf40f32d5f7c500fefb
-
SHA1
08195d91e8e187c4edfb03e3fa6784524481802a
-
SHA256
0c6b9d6c37b17c04112ce5b33b8b7770c483cb70b1e28f66d06d1bbf8384c777
-
SHA512
daa05b7159d649dcb9e7c07c010b777daee79df18c0fb0d60364e942282dc1f1d63b9c0b1929f8217000e63c3526b7464133c08e42e21be392337e4c3724fad1
-
SSDEEP
768:vuK49TH4EjZWUR+ejmo2qrL/ot3APIPzjbogX3a7bsaN3KnVABDZXx:vuK49THf520s3lP3b/XKUaN3CWdXx
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-