Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78.exe

  • Size

    790KB

  • Sample

    240214-f9ksysbe66

  • MD5

    c8b4fb2984a495c19cc5d4dcc1922914

  • SHA1

    bbc25258b543805926d034564015a2e4d40b0647

  • SHA256

    8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78

  • SHA512

    d084a9565d9cd7137969bc0cfb2dad3e2370451715dccf89906eafbb2ecbdf20bc8e654ff4aaa8facf5bd8931861f8e3df4cf5f1079431debadeff93b37c2205

  • SSDEEP

    12288:T6tHgfBPsucbAapcfyTAKQrj86Hil5QaHRnxiWUotpA5Xturz1J+mZWwVVVVVVVX:T6tHwxEAapcaXBxRwWFtpAzs1IWb/T

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

TORREMENOR

C2

danielballesterosdominper.con-ip.com:4040

Mutex

Cookies

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78.exe

    • Size

      790KB

    • MD5

      c8b4fb2984a495c19cc5d4dcc1922914

    • SHA1

      bbc25258b543805926d034564015a2e4d40b0647

    • SHA256

      8545fedaeb113fdb4000b3f6a8d0f0f4694f9198203086a7d1230385a5180f78

    • SHA512

      d084a9565d9cd7137969bc0cfb2dad3e2370451715dccf89906eafbb2ecbdf20bc8e654ff4aaa8facf5bd8931861f8e3df4cf5f1079431debadeff93b37c2205

    • SSDEEP

      12288:T6tHgfBPsucbAapcfyTAKQrj86Hil5QaHRnxiWUotpA5Xturz1J+mZWwVVVVVVVX:T6tHwxEAapcaXBxRwWFtpAzs1IWb/T

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Detects file containing reversed ASEP Autorun registry keys

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks