Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

  • Size

    471KB

  • Sample

    231120-erjmhadg29

  • MD5

    451e3b19fe10341975c75a042f23ac19

  • SHA1

    3486752c4de5f9b5a5648b6e48f7d734081eaba5

  • SHA256

    f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

  • SHA512

    3e630aea6c9d5c7bc4d5a6c6895b2a1e10be3cc3b03296d7503f5d3c65e12fcf4785a3e094dbd90b8a0dfb03326982fbf6b212939b3c12d2c0a5ec09190b35bd

  • SSDEEP

    12288://fQ47T2ynG/4oVM98VTWdEr/XTp4SHfs5uY7kp9:/NutM98VTWar/Tp4AfF

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

154.12.87.251:8301

Mutex

ldpngdrfsydcgfxi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

    • Size

      471KB

    • MD5

      451e3b19fe10341975c75a042f23ac19

    • SHA1

      3486752c4de5f9b5a5648b6e48f7d734081eaba5

    • SHA256

      f008799d9dd1d51941e0339230128dc0d83acacf8d13556a58053a3f1daecfee

    • SHA512

      3e630aea6c9d5c7bc4d5a6c6895b2a1e10be3cc3b03296d7503f5d3c65e12fcf4785a3e094dbd90b8a0dfb03326982fbf6b212939b3c12d2c0a5ec09190b35bd

    • SSDEEP

      12288://fQ47T2ynG/4oVM98VTWdEr/XTp4SHfs5uY7kp9:/NutM98VTWar/Tp4AfF

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks