Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
AA_v3.5.exe
-
Size
391KB
-
Sample
230707-lrpl3shc6t
-
MD5
541787f846aab96e4b5a0236a0e13229
-
SHA1
39a6f6eb3ce252a1a25bd48cd3e34b198ceeee52
-
SHA256
0a7e27421e535b074b4fc4a7abc742ff232149a120a928a011f5428ace1413df
-
SHA512
a57ce2f745da28d2240c446d90b33d04afe5f61c5d66ab5795e4bb91544c284961505e77eb2c10f533e93bd81ea773dc0a8eeb8d4b6690466d581270ffd1bcf5
-
SSDEEP
6144:3ByN2rwOyoOLWrtcMU9GcsQn5UEbY+lmDjArqvw+UVipjS6eMaAT03e2YqKSgpjd:RyaaWQ9Ym2EbNEAGvJ+iU6/QlKJm4jTl
Behavioral task
behavioral1
Sample
Device/HarddiskVolume6/Downloads/AA_v3.5.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
Device/HarddiskVolume6/Downloads/AA_v3.5.exe
Resource
win10v2004-20230703-en
Malware Config
Targets
-
-
Target
Device/HarddiskVolume6/Downloads/AA_v3.5.exe
-
Size
746KB
-
MD5
2cbf5657ffd8858a9597f296a60270c2
-
SHA1
b130611c92788337c4f6bb9e9454ff06eb409166
-
SHA256
9b3f4d6a9bae4d7f9cfe45e706db8fe4baef51ae12353941e8b1532b231e6eac
-
SHA512
06339a299c8c9ce55e9b96582e54e0bf9e04f894ceb47c07486adf8b0140c2a01fd0932207aca8112ee0b16ba8711fee9435e37339aafb94f167b5a736ee7d0b
-
SSDEEP
12288:6NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:6XTszE7PTgM0YOgA4RtcbwhsSYFVL
Score10/10-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-