Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Proxys_CG.rar
-
Size
13.6MB
-
Sample
230419-v4jq2acc97
-
MD5
5e5a38a2ddd706f5497e9d26ee4f548d
-
SHA1
5a84762e9332834f2d5438cccb2d8f5db68f9c5f
-
SHA256
1c4b98c8316dc6822d7fec7ffd30e1d1070b4981d5d19d3e23abcfcfb5b26322
-
SHA512
e325fd5b7547d9f3e445843df1d0c6f0b1e84e011b06b1cbc68d24a95504ec145e97180db561eef42206ceec01f3522ee2194909271b9b6439340595c8f6c280
-
SSDEEP
393216:arLbXMuouXScdwxADvk9KxwxWn0I5CyUH/HC:abMuokScd5vkBDmJUfHC
Static task
static1
Malware Config
Extracted
xworm
vfggfhd.servemp3.com:4444
swTfenM3uXIVcBaq
-
install_file
USB.exe
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5984178452:AAG6gENrQhQhIMDZBJkIZ8WStQLjakgKSsk/sendMessage?chat_id=5529838804
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
Proxys_CG/Proxy_Scrape.exe
-
Size
27.3MB
-
MD5
5ce779c2c9652041aecf26eba68b5ae8
-
SHA1
b6fb791025d150dd032169e47b91e218cd3d047d
-
SHA256
909ead44e10fab229813da2813b7a268bdfc3f262e7dfc0eaed0a9ae5b265d12
-
SHA512
8bc042e4e724cdfe75c073511307c5d0fb5c479796d172f53da74e70ccc2dd00da0207b32d3ca4958c9b7ea93bc5a9000582b9cef0d3d784b5dc5a2289b03361
-
SSDEEP
393216:PWI7KzlGt0Yx3SRfBKP+ni4zhavd3vhytubv8:PJ0I3QfBKmaVJPbU
-
StormKitty payload
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-