Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
08e2246fa2d8e30547f8c42acb82c305.exe
-
Size
3.1MB
-
Sample
240428-wsla6add82
-
MD5
08e2246fa2d8e30547f8c42acb82c305
-
SHA1
13e4ef288407cee06c4819ce6d3dde27e8535334
-
SHA256
512eae984c0fd479fdcd2f73253fc52adeed18d104dff390b5b9563b3ca8dff5
-
SHA512
8e29ba0b236ccf279a8628b26fecbcf1787add8528974b7d85771cc3dae2ff052ce0b3f71d73ac2d7ae9ed20d53dda98c4885c0046c6042e9199149a4ad3c186
-
SSDEEP
49152:p7cguPcJ1auqGqomYaXuRq/BxxjAoV4sROsaChi39Q5kr0gNf5dpDrYN:NplJhqQ4ueB8UQSw9Q5K3nYN
Static task
static1
Behavioral task
behavioral1
Sample
08e2246fa2d8e30547f8c42acb82c305.exe
Resource
win7-20240220-en
Malware Config
Extracted
asyncrat
0.5.7B
Default
aysmasterpro.duckdns.org:8795
jhyhgghf6SI8OkPnk
-
delay
3
-
install
true
-
install_file
system.exe
-
install_folder
%AppData%
Targets
-
-
Target
08e2246fa2d8e30547f8c42acb82c305.exe
-
Size
3.1MB
-
MD5
08e2246fa2d8e30547f8c42acb82c305
-
SHA1
13e4ef288407cee06c4819ce6d3dde27e8535334
-
SHA256
512eae984c0fd479fdcd2f73253fc52adeed18d104dff390b5b9563b3ca8dff5
-
SHA512
8e29ba0b236ccf279a8628b26fecbcf1787add8528974b7d85771cc3dae2ff052ce0b3f71d73ac2d7ae9ed20d53dda98c4885c0046c6042e9199149a4ad3c186
-
SSDEEP
49152:p7cguPcJ1auqGqomYaXuRq/BxxjAoV4sROsaChi39Q5kr0gNf5dpDrYN:NplJhqQ4ueB8UQSw9Q5K3nYN
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-