Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb.exe
-
Size
11.7MB
-
Sample
240517-b3hb2abf64
-
MD5
4cbf5db190e95e44d2a637e3513cb39f
-
SHA1
0f83db9b94d8d3975116732282364ee7aa8d142f
-
SHA256
84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb
-
SHA512
a4d0fb58ceabe86f7f3ce81624d7ab60fcde15bed4b928eaf03ed431230052b814d0a483b67ca42afa5dbb0fd9bb02043a6c52db4b980b6fde7d0357d5773193
-
SSDEEP
196608:0vcp1Se3LVaChCXpogOPA53p79DMG/TiOyg:13h/g/OE3p5Dxby
Static task
static1
Behavioral task
behavioral1
Sample
84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Default
94.156.69.161:8900
94.156.69.161:4443
94.156.69.163:8900
94.156.69.163:4443
94.156.69.164:8900
94.156.69.164:4443
94.156.69.165:8900
94.156.69.165:4443
94.156.69.166:8900
94.156.69.166:4443
91.92.248.82:8900
91.92.248.82:4443
91.92.251.136:8900
91.92.251.136:4443
91.92.251.153:8900
91.92.251.153:4443
91.92.251.159:8900
91.92.251.159:4443
91.92.251.179:8900
91.92.251.179:4443
91.92.251.245:8900
91.92.251.245:4443
91.92.254.21:8900
91.92.254.21:4443
91.92.254.201:8900
91.92.254.201:4443
91.92.255.16:8900
91.92.255.16:4443
91.92.255.25:8900
91.92.255.25:4443
91.92.255.79:8900
91.92.255.79:4443
94.156.64.5:8900
94.156.64.5:4443
94.156.64.21:8900
94.156.64.21:4443
94.156.64.51:8900
94.156.64.51:4443
94.156.64.90:8900
94.156.64.90:4443
sqhylkrhlwjrecxiv
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb.exe
-
Size
11.7MB
-
MD5
4cbf5db190e95e44d2a637e3513cb39f
-
SHA1
0f83db9b94d8d3975116732282364ee7aa8d142f
-
SHA256
84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb
-
SHA512
a4d0fb58ceabe86f7f3ce81624d7ab60fcde15bed4b928eaf03ed431230052b814d0a483b67ca42afa5dbb0fd9bb02043a6c52db4b980b6fde7d0357d5773193
-
SSDEEP
196608:0vcp1Se3LVaChCXpogOPA53p79DMG/TiOyg:13h/g/OE3p5Dxby
Score10/10-
Detects executables attemping to enumerate video devices using WMI
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-