Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1744-69-0x0000000008FF0000-0x0000000009006000-memory.dmp
-
Size
88KB
-
Sample
240313-chwvcsbe95
-
MD5
432629bf35ba0002c9521e92a3d74a45
-
SHA1
9f084badb89a311dfa4482613d87602fc86b3491
-
SHA256
c6f12f257c2f60ae52265ebc64e97b60662c89ec70bb1c5276365ca69218043a
-
SHA512
01c16779932c96051e4d2f98124ede3d2249478da52c0c229001318d81088a933d42ce18b8ed40a78fbd0573b56f6447bcce40957587edf170b4a58ad613cbe0
-
SSDEEP
1536:CZyvHdF4s6OJaGr1eeiIVrGbbXwIHxen1GeDpqKmY7:CZyvHdF4s6ONrIeXGbbX3qgz
Behavioral task
behavioral1
Sample
1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1744-69-0x0000000008FF0000-0x0000000009006000-memory.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
127.0.0.1:4489
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
se.exe
-
install_folder
%AppData%
Targets
-
-
Target
1744-69-0x0000000008FF0000-0x0000000009006000-memory.dmp
-
Size
88KB
-
MD5
432629bf35ba0002c9521e92a3d74a45
-
SHA1
9f084badb89a311dfa4482613d87602fc86b3491
-
SHA256
c6f12f257c2f60ae52265ebc64e97b60662c89ec70bb1c5276365ca69218043a
-
SHA512
01c16779932c96051e4d2f98124ede3d2249478da52c0c229001318d81088a933d42ce18b8ed40a78fbd0573b56f6447bcce40957587edf170b4a58ad613cbe0
-
SSDEEP
1536:CZyvHdF4s6OJaGr1eeiIVrGbbXwIHxen1GeDpqKmY7:CZyvHdF4s6ONrIeXGbbX3qgz
Score10/10-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-