Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
251523fa1b013d8ca82ab08f177d3ab2.exe
-
Size
49KB
-
Sample
230609-jwjwaacc7t
-
MD5
251523fa1b013d8ca82ab08f177d3ab2
-
SHA1
ff641e25cb287db90de6f59786a9a940aa2c5bee
-
SHA256
515e5105f1bda9207f1342220ecaddc6dc04b8aa54149e7cc7ccb38225845d03
-
SHA512
63316282cb55b46fbf5b4c95f4ec39cb59fd7b775c4c1dec4db502b8957ff41c31de3b7b7526c8bfe9c79d68070c433d78ce9d51848d51e9e57a3b3639367ef5
-
SSDEEP
1536:luqY9T9xy2eD3bmXSTLNI98P0wx8vV9XdD4C:luqUT9xy2eD3bmsxI9S8vVhR4C
Behavioral task
behavioral1
Sample
251523fa1b013d8ca82ab08f177d3ab2.exe
Resource
win7-20230220-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
nasihej725.hopto.org:6606
Microsoft_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
Windows Session Control.exe
-
install_folder
%AppData%
Targets
-
-
Target
251523fa1b013d8ca82ab08f177d3ab2.exe
-
Size
49KB
-
MD5
251523fa1b013d8ca82ab08f177d3ab2
-
SHA1
ff641e25cb287db90de6f59786a9a940aa2c5bee
-
SHA256
515e5105f1bda9207f1342220ecaddc6dc04b8aa54149e7cc7ccb38225845d03
-
SHA512
63316282cb55b46fbf5b4c95f4ec39cb59fd7b775c4c1dec4db502b8957ff41c31de3b7b7526c8bfe9c79d68070c433d78ce9d51848d51e9e57a3b3639367ef5
-
SSDEEP
1536:luqY9T9xy2eD3bmXSTLNI98P0wx8vV9XdD4C:luqUT9xy2eD3bmsxI9S8vVhR4C
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-