Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    832506397be8817683e8dcac4604eaee19f0add472b9332cb667067562487896.exe

  • Size

    480KB

  • Sample

    240222-gp615ach9y

  • MD5

    2eff738980e22cf3f48b9cf8b78663ac

  • SHA1

    419d1ae415f048372bc9fbb99f7a050f0f7f88e5

  • SHA256

    832506397be8817683e8dcac4604eaee19f0add472b9332cb667067562487896

  • SHA512

    7d4973802a0615d6f64a1941f38f6d12d01b49315b07ddbc157261b32572745ae4bc07a9ff3d780596ed1f6bc9c873ffef20e8842d572dadbaea5e6d68964e3f

  • SSDEEP

    12288:j50R0MugiOXNbIxUTcKtt904GBfo3Jqlpjg:jyOMugiOCxUAitQu3Jqb

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6B

C2

185.222.58.40:1978

Mutex

qmwtmuxejofbqhzba

Attributes
  • delay

    5

  • install

    true

  • install_file

    windocv.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      832506397be8817683e8dcac4604eaee19f0add472b9332cb667067562487896.exe

    • Size

      480KB

    • MD5

      2eff738980e22cf3f48b9cf8b78663ac

    • SHA1

      419d1ae415f048372bc9fbb99f7a050f0f7f88e5

    • SHA256

      832506397be8817683e8dcac4604eaee19f0add472b9332cb667067562487896

    • SHA512

      7d4973802a0615d6f64a1941f38f6d12d01b49315b07ddbc157261b32572745ae4bc07a9ff3d780596ed1f6bc9c873ffef20e8842d572dadbaea5e6d68964e3f

    • SSDEEP

      12288:j50R0MugiOXNbIxUTcKtt904GBfo3Jqlpjg:jyOMugiOCxUAitQu3Jqb

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Detects file containing reversed ASEP Autorun registry keys

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks