Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222.exe

  • Size

    46.7MB

  • Sample

    240417-by33yabe4t

  • MD5

    4410dbdf8f12dfbf1f165276c42444fe

  • SHA1

    41636f267072fec4554293c8d6abe148e1e67cc6

  • SHA256

    61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222

  • SHA512

    33b4aa2617a3cf96623c66e67fcb22a96ca78df4829773de94ac75ea6749cf85842429e9383b720afa8937594e235c6ea02e81acb833713fa1f90ef18e0505e0

  • SSDEEP

    786432:Nkmk80dcNz5mU7FgDHNM2RXKxN1bfHRz8CGj7IBLbTSR/4ibob+XAkqdvDjhr:Dk5cNUUJgrNPOFfxFGjMBLKLbob+XCdl

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

C2

dgorijan20785.hopto.org:6606

dgorijan20785.hopto.org:7707

dgorijan20785.hopto.org:8808

Mutex

v5tvc4rc3ex788

Attributes
  • delay

    10

  • install

    true

  • install_file

    audiodrv.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222.exe

    • Size

      46.7MB

    • MD5

      4410dbdf8f12dfbf1f165276c42444fe

    • SHA1

      41636f267072fec4554293c8d6abe148e1e67cc6

    • SHA256

      61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222

    • SHA512

      33b4aa2617a3cf96623c66e67fcb22a96ca78df4829773de94ac75ea6749cf85842429e9383b720afa8937594e235c6ea02e81acb833713fa1f90ef18e0505e0

    • SSDEEP

      786432:Nkmk80dcNz5mU7FgDHNM2RXKxN1bfHRz8CGj7IBLbTSR/4ibob+XAkqdvDjhr:Dk5cNUUJgrNPOFfxFGjMBLKLbob+XCdl

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Detects file containing reversed ASEP Autorun registry keys

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks