Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
raped.exe
-
Size
48KB
-
Sample
230513-2wwh7acb5v
-
MD5
d404de59b492053bb4c7b214a56b2b09
-
SHA1
0107bea371f1075c60a1a366211bbb3f8d5aa224
-
SHA256
9ab26f70c71a11a7182abf5439b217c15c64163226626e4d823a239194c1f97b
-
SHA512
310dfb551d529d98305cb559c9135c36b647b7b8af0807107b870f4a12e8cfb6d918eb388c4a92503cbea6c40b4199bbb04a7926b60b7cbe28689192e16d1722
-
SSDEEP
768:MukzVT0kLd3WULgPdVmo2qDiOfrWHBaeqPI6FRCCwc00bG/O8NpLWOZigj+8Xq7e:MukzVT0Mq12FOXeT6R7w+bGVn0X8Xq7e
Behavioral task
behavioral1
Sample
raped.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
fucked.exe
-
install_folder
%AppData%
Targets
-
-
Target
raped.exe
-
Size
48KB
-
MD5
d404de59b492053bb4c7b214a56b2b09
-
SHA1
0107bea371f1075c60a1a366211bbb3f8d5aa224
-
SHA256
9ab26f70c71a11a7182abf5439b217c15c64163226626e4d823a239194c1f97b
-
SHA512
310dfb551d529d98305cb559c9135c36b647b7b8af0807107b870f4a12e8cfb6d918eb388c4a92503cbea6c40b4199bbb04a7926b60b7cbe28689192e16d1722
-
SSDEEP
768:MukzVT0kLd3WULgPdVmo2qDiOfrWHBaeqPI6FRCCwc00bG/O8NpLWOZigj+8Xq7e:MukzVT0Mq12FOXeT6R7w+bGVn0X8Xq7e
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-