Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    500CASINO.Crash.Predictor.rar

  • Size

    21.4MB

  • Sample

    231011-hjj5vafg3s

  • MD5

    0a2568560da25132d039fb81e40f2b70

  • SHA1

    c791854847c52a42a2a9d2f7751b8f327789bb5d

  • SHA256

    9be723eb1883932143234a8aecc303d54ee2b9456c2ef7a195ccb38cae50582a

  • SHA512

    fb8371dac3e7a7b3e7f31c839645ee3035a135701c04a803b4a866ca97f4bab77db6957d8cc2ac779ccb12c1ca4e77608dd0c2dd871cd40da155ffb3aa103e9b

  • SSDEEP

    393216:MSX8F8RLC2wb6Ep8vmQEz0EZ5DLPZJejcIUTsJQqJe0VqvOaUpraDup:BX8F0LobhhQ0HvEmTsJJR8ZUpj

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

500CASINO

C2

windowsignn.theworkpc.com:6606

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      500CASINO Crash Predictor/500CASINO Crash Predictor.exe

    • Size

      217KB

    • MD5

      41ea1432ba11237dbb1f7bc7465a3f92

    • SHA1

      7beb7a67e009f8256ad4b059f4257c605f8bc5e6

    • SHA256

      b979a84bfe350f25b7e9f18d9b66c1adf0c14225e10face5650e4df7621e2d31

    • SHA512

      f577261c37d1d3eb34f80179591db9b61f7ed45a83ed7b458be6f79785e61218d3713d4efa0d32a1aba0a88b46c0af144a117e68f973d7c5931b303d15da0900

    • SSDEEP

      1536:9Fe8KXo3TECoH1lYOdKtwVcl8mJmtupKQ:9wajECoH1lbKtqYFJmq

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Target

      500CASINO Crash Predictor/Newtonsoft.Json.dll

    • Size

      683KB

    • MD5

      6815034209687816d8cf401877ec8133

    • SHA1

      1248142eb45eed3beb0d9a2d3b8bed5fe2569b10

    • SHA256

      7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814

    • SHA512

      3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

    • SSDEEP

      12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc

    Score
    1/10
    • Target

      500CASINO Crash Predictor/converter.exe

    • Size

      192KB

    • MD5

      11881966a4189b6066c4349e85c07f91

    • SHA1

      d45412bea6c4dcfa346626f8c7d925329e8131aa

    • SHA256

      0279c9fb78efe308a8dc792fbf1bbd09fe63ffb3ba2cda716fe822c60d1e4482

    • SHA512

      2445929aac344314dd019d160a35eab1a5191644f27f57c21e71509ca4b829bcc628cc36851ebc10cec2bdf77f8b4925d46f4344677649412e8c35cb6fc01ca8

    • SSDEEP

      3072:HK71obs9cD3WTwzi1hItVgLzWbtIphS2RH77HvAtAFjGC8olv8/lNPQB:q7iufWlIbS2RHXHvAtAFjGC8olv8/la

    Score
    1/10
    • Target

      500CASINO Crash Predictor/dotnet/Startup.exe

    • Size

      208KB

    • MD5

      2b81bfa1899b89857f37cd9fe654b542

    • SHA1

      8939f4d7b936c4251d1f1a290a2e2f5af04e0884

    • SHA256

      1679863d9dcf857ca805cd43bd6495c7ac73835d2f6402abf8b914a54cb144d7

    • SHA512

      542d4ff941c578f25070f48fdd169679a2ac45c77040006588eba35c9b5635f344e8ae25927b2d9d4fe7dd9f57b6a942790efdc7e268f07fbfbcc19e0a174075

    • SSDEEP

      768:tdzGnKIowC7Cf3TzAsJoH1l3Ym8OdF+c5tuSsxYho:tV8KXo3TECoH1lYOdFwSsxmo

    Score
    1/10
    • Target

      500CASINO Crash Predictor/dotnet/strapdll.dll

    • Size

      259KB

    • MD5

      048d6b9d6ce5007914a2f05ee4c0325d

    • SHA1

      9d6e22c1a0f867886bfc9b4491cc5a8cb2f8aba9

    • SHA256

      3e3dd3b3b65df50fe8a27d6563dea3e2084d6f830186c3981b61367ebbc00ddd

    • SHA512

      bf4f682b6eee7ee9e7994a633513ea6ae8c84a678649d0eceeccbaff5522fdeadb44fd371825b0bedf130e841ad2d27c7164c8a3511631211b420b2ea2b9a900

    • SSDEEP

      6144:Ab8J9pJileNFwznh+YfAwwtHuIX8dnc4Luq/U+5+4Bgp+80xusB:AYJH9NFwfAwwtOIMdc4Luq/IuYauk

    Score
    1/10
    • Target

      500CASINO Crash Predictor/driver/rawaccel.sys

    • Size

      49KB

    • MD5

      71f344ff16eef68a0805b747ea9ab85a

    • SHA1

      3224069aaec50d57f7ff2db31064fd14f95cb9ea

    • SHA256

      fc1d9eef1f99951f14e53e14250ef944c5dcd82117497a1eaf5ced6623b6855a

    • SHA512

      338b2ecf11a0e62bf70f8fa55dc27ef13f7e54fd01611b4fc7c5788a612540dfe8f9ddd2688868afb326e616a9440e47ca3d703c322e993989035e611797400c

    • SSDEEP

      768:mGFZ5+o2cZsU134/sSqGCHzn52Ene4ExHtq6Cbf2Q+IRNJ4/UOdt3s4:mGZ8oZJ40Hj554HoUqNJ4sOdtc4

    Score
    1/10
    • Target

      500CASINO Crash Predictor/installer.exe

    • Size

      60KB

    • MD5

      7c9fe766edc6e96f0ba7f8545b32a51a

    • SHA1

      c43950f33630cc0602b7ec3f9ffc483084df6190

    • SHA256

      96cbd4ba183f570ba5f24aaf693f49e2227a7485a06bd176f6224c52f980a0ad

    • SHA512

      e874f3ca3af0d0cfefde78b9978acda857c8b993a4a6dcb83008e3e79fc80081aaa31b6699e4e0bc76ece31e85692a0d74313894a0d9b03b7d9ef924bea57ede

    • SSDEEP

      1536:1Aujzkv4P9A2NjPm3WG21KmUIFXVzxWOEW9:14gP9A2NjPmGG2SIFXVzxWO/

    Score
    8/10
    • Drops file in Drivers directory

    • Target

      500CASINO Crash Predictor/uninstaller.exe

    • Size

      53KB

    • MD5

      167a45d1b7e3d03c634053f6027c43d5

    • SHA1

      4effde6ee1d8aaf763d36e40bb97a2f455360696

    • SHA256

      944946946b3e853dff5ad058dedbe7fb81d0c5aa2c45a39b0e2b47fd3b42f561

    • SHA512

      443ab740d95ccb8a17317c6dcf4a117f1b1455c7b266dc3e93d62c308f332c9934d662e2fcb9472fecdcc532a2899a2e28a4d2c4922fbf540f09b00f4b7819d4

    • SSDEEP

      768:WUZvMEHiP3xj/o4xshmrUJ1kFXnbBQ5fmPv8OfBHXu5P2hwCVEV3GPkjvS:W4mP3JDQJ1kFemPUOfVu5euCOESS

    Score
    1/10
    • Target

      500CASINO Crash Predictor/wrapper.dll

    • Size

      306KB

    • MD5

      aa082d6cb425eb8c18fbbdc357dba9b4

    • SHA1

      f41254ca271453b8b6dea1fe60cd98c52e27b649

    • SHA256

      187155504c582e6d6c6e46c9cc0ce54a65cf627d3afbf73fb8d74d456b29e143

    • SHA512

      65a693cc597558c10eee27a2a836aa5a593d68ddc5978164ee7982b218a4c58a9480ce9be6e6a917968c1c9257b72dbfc6125e7efb2eae0e6397ba66b4491fec

    • SSDEEP

      6144:+WutAlrKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKX:tKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKm

    Score
    1/10
    • Target

      500CASINO Crash Predictor/writer.exe

    • Size

      5KB

    • MD5

      4d0b240c4e88a88fdf7ea4e88339cc98

    • SHA1

      9d70f3bfb5ba8fd03b4d48da166ff4870886c2ce

    • SHA256

      33e9c1917cce05bef33df11ae7e3811adad481a340825bb2df060feb9038738a

    • SHA512

      9191d111913fc079ecfd77ea5862e2d5d987043b16fa932e86c8403ad7b2438fda4deabaff5aee6237b7ac2e899b37d2605bcd0158bea3966fb81876cafe400a

    • SSDEEP

      48:6QRqYzSUD0PUZ8EJiNRHTYhYlgsJrNM1p5OOlNuSey8gYzBbIIPZsFtXsuhlQyRY:/xX0s5JokhYysJe80uVmYzB8hfzNt

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks