Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222.exe
-
Size
46.7MB
-
Sample
240417-by33yabe4t
-
MD5
4410dbdf8f12dfbf1f165276c42444fe
-
SHA1
41636f267072fec4554293c8d6abe148e1e67cc6
-
SHA256
61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222
-
SHA512
33b4aa2617a3cf96623c66e67fcb22a96ca78df4829773de94ac75ea6749cf85842429e9383b720afa8937594e235c6ea02e81acb833713fa1f90ef18e0505e0
-
SSDEEP
786432:Nkmk80dcNz5mU7FgDHNM2RXKxN1bfHRz8CGj7IBLbTSR/4ibob+XAkqdvDjhr:Dk5cNUUJgrNPOFfxFGjMBLKLbob+XCdl
Behavioral task
behavioral1
Sample
61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222.exe
Resource
win7-20240221-en
Malware Config
Extracted
asyncrat
0.5.6A
dgorijan20785.hopto.org:6606
dgorijan20785.hopto.org:7707
dgorijan20785.hopto.org:8808
v5tvc4rc3ex788
-
delay
10
-
install
true
-
install_file
audiodrv.exe
-
install_folder
%AppData%
Targets
-
-
Target
61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222.exe
-
Size
46.7MB
-
MD5
4410dbdf8f12dfbf1f165276c42444fe
-
SHA1
41636f267072fec4554293c8d6abe148e1e67cc6
-
SHA256
61e869da1d5cefe780a706e06b904c276d8393e618de382c3b4abdbb4d817222
-
SHA512
33b4aa2617a3cf96623c66e67fcb22a96ca78df4829773de94ac75ea6749cf85842429e9383b720afa8937594e235c6ea02e81acb833713fa1f90ef18e0505e0
-
SSDEEP
786432:Nkmk80dcNz5mU7FgDHNM2RXKxN1bfHRz8CGj7IBLbTSR/4ibob+XAkqdvDjhr:Dk5cNUUJgrNPOFfxFGjMBLKLbob+XCdl
-
Async RAT payload
-
Detects file containing reversed ASEP Autorun registry keys
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-