Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
anarchia.exe
-
Size
63KB
-
Sample
240701-rz8mtaxalb
-
MD5
0b2ea56da9323d28eb13700901a3d821
-
SHA1
beac98a0e292050ce6fda1efdb550342861427dd
-
SHA256
9b0ceae770fefa240406c89e24ad6468397db6c3105ea4bd800e433fd608cbd3
-
SHA512
a26783b1ae66fa56a4162dc893ec5865e009e1cd94862edb2933099fd81e70883ef2aa4a6de5d876c73670df31abd899d3682a47fcc458b9995ea5d0e9b71ab8
-
SSDEEP
1536:xRRQOw8kwch5bUbWh9aiEABuEdpqKmY7:xA18k3bUbW6eGz
Malware Config
Extracted
asyncrat
Default
185.254.97.15:2024
-
delay
1
-
install
true
-
install_file
cwel.exe
-
install_folder
%AppData%
Targets
-
-
Target
anarchia.exe
-
Size
63KB
-
MD5
0b2ea56da9323d28eb13700901a3d821
-
SHA1
beac98a0e292050ce6fda1efdb550342861427dd
-
SHA256
9b0ceae770fefa240406c89e24ad6468397db6c3105ea4bd800e433fd608cbd3
-
SHA512
a26783b1ae66fa56a4162dc893ec5865e009e1cd94862edb2933099fd81e70883ef2aa4a6de5d876c73670df31abd899d3682a47fcc458b9995ea5d0e9b71ab8
-
SSDEEP
1536:xRRQOw8kwch5bUbWh9aiEABuEdpqKmY7:xA18k3bUbW6eGz
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-