Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Vnd Vietco...df.exe

windows7-x64

10

Vnd Vietco...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Vnd Vietcombankpdf.exe

  • Size

    164KB

  • Sample

    230512-frd8fsbg95

  • MD5

    17a37bf8286737da1e6b94f8094ca1c1

  • SHA1

    4c926d254cdc3bc5f243f97b5602cbae2d9669a5

  • SHA256

    5d318ad1fa11ca3660fe35faff0e0aaef8acd820e01cdd5ee7305c30314f5303

  • SHA512

    66c3ba7121ed0485fb9dbef897f15baf2920575aec6e3d3b773ca36052b09217df277a7127c6e907241d62f0c239f1099c5e43ad3c811c84f5323d2e1d9357ca

  • SSDEEP

    3072:XfY/TU9fE9PEtuAbx1qh8nA7Yg75h/zu3GOFkqqymeiy5wt8biswBM6GZ7wzG48:PYa6cxchIAR5h/zLak+mPtIisW8gV8

Score
10/10
asyncratdefaultpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

141.98.102.235:16296

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Vnd Vietcombankpdf.exe

    • Size

      164KB

    • MD5

      17a37bf8286737da1e6b94f8094ca1c1

    • SHA1

      4c926d254cdc3bc5f243f97b5602cbae2d9669a5

    • SHA256

      5d318ad1fa11ca3660fe35faff0e0aaef8acd820e01cdd5ee7305c30314f5303

    • SHA512

      66c3ba7121ed0485fb9dbef897f15baf2920575aec6e3d3b773ca36052b09217df277a7127c6e907241d62f0c239f1099c5e43ad3c811c84f5323d2e1d9357ca

    • SSDEEP

      3072:XfY/TU9fE9PEtuAbx1qh8nA7Yg75h/zu3GOFkqqymeiy5wt8biswBM6GZ7wzG48:PYa6cxchIAR5h/zLak+mPtIisW8gV8

    Score
    10/10
    asyncratdefaultpersistencerat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks