Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

  • Size

    471KB

  • Sample

    231120-erjmhadg29

  • MD5

    451e3b19fe10341975c75a042f23ac19

  • SHA1

    3486752c4de5f9b5a5648b6e48f7d734081eaba5

  • SHA256

    f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

  • SHA512

    3e630aea6c9d5c7bc4d5a6c6895b2a1e10be3cc3b03296d7503f5d3c65e12fcf4785a3e094dbd90b8a0dfb03326982fbf6b212939b3c12d2c0a5ec09190b35bd

  • SSDEEP

    12288://fQ47T2ynG/4oVM98VTWdEr/XTp4SHfs5uY7kp9:/NutM98VTWar/Tp4AfF

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

154.12.87.251:8301

Mutex

ldpngdrfsydcgfxi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
3qC741eCnFienNfdPGyWvyAS1b4IZB0P

Targets

    • Target

      f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

    • Size

      471KB

    • MD5

      451e3b19fe10341975c75a042f23ac19

    • SHA1

      3486752c4de5f9b5a5648b6e48f7d734081eaba5

    • SHA256

      f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

    • SHA512

      3e630aea6c9d5c7bc4d5a6c6895b2a1e10be3cc3b03296d7503f5d3c65e12fcf4785a3e094dbd90b8a0dfb03326982fbf6b212939b3c12d2c0a5ec09190b35bd

    • SSDEEP

      12288://fQ47T2ynG/4oVM98VTWdEr/XTp4SHfs5uY7kp9:/NutM98VTWar/Tp4AfF

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.