Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Nigger.exe
-
Size
47KB
-
Sample
240605-rvn3lsaf25
-
MD5
67e6c2eefb8ba3bc7fe0aec4a4f172a1
-
SHA1
27185e264b533529ae6db394e58ff419dde73a56
-
SHA256
d1c4c47b1f2f1051ef592fc6fcd285cdafbd0213577eeecc353bd2beb8e33367
-
SHA512
49bd659605edef13b1961a6179985a87af5324e7c46843524ed2789189089b0f254f719d737ecfa737b5991d00761b2ed33fcf778a380efc0ec76ef622d0c42d
-
SSDEEP
768:gq+s3pUtDILNCCa+DiUYOt2iE78YbBgYnb4i7SvEgK/JHZVc6KN:gq+AGtQOUYOt0zbu2dSnkJHZVclN
Behavioral task
behavioral1
Sample
Nigger.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
asyncrat
1.0.7
Default
127.0.0.1:8080
127.0.0.1:13857
0.tcp.eu.ngrok.io:8080
0.tcp.eu.ngrok.io:13857
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
Nigger.exe
-
Size
47KB
-
MD5
67e6c2eefb8ba3bc7fe0aec4a4f172a1
-
SHA1
27185e264b533529ae6db394e58ff419dde73a56
-
SHA256
d1c4c47b1f2f1051ef592fc6fcd285cdafbd0213577eeecc353bd2beb8e33367
-
SHA512
49bd659605edef13b1961a6179985a87af5324e7c46843524ed2789189089b0f254f719d737ecfa737b5991d00761b2ed33fcf778a380efc0ec76ef622d0c42d
-
SSDEEP
768:gq+s3pUtDILNCCa+DiUYOt2iE78YbBgYnb4i7SvEgK/JHZVc6KN:gq+AGtQOUYOt0zbu2dSnkJHZVclN
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Renames multiple (2903) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-