Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Pago.xls

  • Size

    146KB

  • Sample

    230411-qgndgsce86

  • MD5

    cb7929cf1abc35c3360f0c675995a551

  • SHA1

    fb773340fe210e3693b4b339696d9b849d4ed4e6

  • SHA256

    f8569a28afa079072bf1faf79e715dda7513e382dc423fc5ee07ec2f54223d24

  • SHA512

    97ee3275dd4362af1ed6f9c627b0dceb0ad65ece0f4d58c8c81a5addc8002def83977f411e4d7fbc7a033928c4a237d256aba7e7c3bec54a13232953e76a5ff2

  • SSDEEP

    3072:FnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAki2PFXSQZb86A4ADAHdVUJgOmCM1y4K:VxEtjPOtioVjDGUU1qfDlavx+W2QnAkG

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Fnock

C2

dnuocc.com:3309

dnuocc.com:8888

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    asri.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Pago.xls

    • Size

      146KB

    • MD5

      cb7929cf1abc35c3360f0c675995a551

    • SHA1

      fb773340fe210e3693b4b339696d9b849d4ed4e6

    • SHA256

      f8569a28afa079072bf1faf79e715dda7513e382dc423fc5ee07ec2f54223d24

    • SHA512

      97ee3275dd4362af1ed6f9c627b0dceb0ad65ece0f4d58c8c81a5addc8002def83977f411e4d7fbc7a033928c4a237d256aba7e7c3bec54a13232953e76a5ff2

    • SSDEEP

      3072:FnxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAki2PFXSQZb86A4ADAHdVUJgOmCM1y4K:VxEtjPOtioVjDGUU1qfDlavx+W2QnAkG

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks