Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
7e1974ea77e2416b2ac75656d1e24da59de0af97815a9e337e4a7cc58f6339a4_JC.exe
-
Size
48KB
-
Sample
231011-xxs28shg72
-
MD5
39fb8a8a40c829ac3a4fd5cd6ea473b7
-
SHA1
5930195043f8a59566d778d15acb31d3c3e5c3a8
-
SHA256
7e1974ea77e2416b2ac75656d1e24da59de0af97815a9e337e4a7cc58f6339a4
-
SHA512
e6d3074a3f2c8d474818d1611d36990b4ab9467f5ffe983ef7572414870c2802e2f353aa02579044c7b51e482bac23424bed9767b8fbb0c41ed16dd328b2beaa
-
SSDEEP
1536:euWk5T1gi29npmgpzmyb+M/oLnOA5UtGhdIR:euWET1gi29pmgpzmyb+/Ld6tI+R
Behavioral task
behavioral1
Sample
7e1974ea77e2416b2ac75656d1e24da59de0af97815a9e337e4a7cc58f6339a4_JC.exe
Resource
win7-20230831-en
Malware Config
Extracted
asyncrat
0.5.7B
Rust
extra-hack.ddns.net:2550
extra-hack.ddns.net:2551
extra-hack.ddns.net:2552
extra-hack.ddns.net:2553
extra-hack.ddns.net:2554
extra-hack.ddns.net:2555
extra-hack.ddns.net:2556
extra-hack.ddns.net:2557
extra-hack.ddns.net:2558
extra-hack.ddns.net:2559
extra-hack.ddns.net:2560
extra-hack.ddns.net:2561
extra-hack.ddns.net:2562
extra-hack.ddns.net:2563
extra-hack.ddns.net:2564
extra-hack.ddns.net:2565
extra-hack.ddns.net:2566
extra-hack.ddns.net:2567
extra-hack.ddns.net:2568
extra-hack.ddns.net:2569
extra-hack.ddns.net:2570
extra-hack.ddns.net:2571
extra-hack.ddns.net:2572
extra-hack.ddns.net:2573
extra-hack.ddns.net:2574
extra-hack.ddns.net:2575
extra-hack.ddns.net:2576
extra-hack.ddns.net:2577
extra-hack.ddns.net:2578
extra-hack.ddns.net:2579
extra-hack.ddns.net:2580
extra-hack.ddns.net:2581
extra-hack.ddns.net:2582
extra-hack.ddns.net:2583
extra-hack.ddns.net:2584
extra-hack.ddns.net:2585
extra-hack.ddns.net:2586
extra-hack.ddns.net:2587
extra-hack.ddns.net:2588
extra-hack.ddns.net:2589
extra-hack.ddns.net:2590
extra-hack.ddns.net:2591
extra-hack.ddns.net:2592
extra-hack.ddns.net:2593
extra-hack.ddns.net:2594
extra-hack.ddns.net:2595
extra-hack.ddns.net:2596
extra-hack.ddns.net:2597
extra-hack.ddns.net:2598
extra-hack.ddns.net:2599
extra-hack.ddns.net:2600
j4hy8gsf6w53x4
-
delay
3
-
install
true
-
install_file
Realtek HD Audio Universal Service.exe
-
install_folder
%AppData%
Targets
-
-
Target
7e1974ea77e2416b2ac75656d1e24da59de0af97815a9e337e4a7cc58f6339a4_JC.exe
-
Size
48KB
-
MD5
39fb8a8a40c829ac3a4fd5cd6ea473b7
-
SHA1
5930195043f8a59566d778d15acb31d3c3e5c3a8
-
SHA256
7e1974ea77e2416b2ac75656d1e24da59de0af97815a9e337e4a7cc58f6339a4
-
SHA512
e6d3074a3f2c8d474818d1611d36990b4ab9467f5ffe983ef7572414870c2802e2f353aa02579044c7b51e482bac23424bed9767b8fbb0c41ed16dd328b2beaa
-
SSDEEP
1536:euWk5T1gi29npmgpzmyb+M/oLnOA5UtGhdIR:euWET1gi29pmgpzmyb+/Ld6tI+R
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-