Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Client.exe

  • Size

    114KB

  • Sample

    240710-3ydltsxcjk

  • MD5

    29e928f1f16131ca36a3aae3467141de

  • SHA1

    9b586f0d13236c3280e5b7b3b592309b296d7fff

  • SHA256

    5e3758c19d761560431f8fd8302aa6d2061568cbed3dc0a20ad3d4f5da93a956

  • SHA512

    3f4ab2b645ec82c9899061973edb92bc4ef4ef3663603dea0de3a37447b8b94577e1357f398bef02f1ce94260f53f25387de72d872a055d7a9482b1f1b256314

  • SSDEEP

    3072:QUVcxhzVCiPMVSe9VdQsH1bf7ADzQL4KvYMC29TwaGwYSOeBY:QtCiPMVSaesVbUzaFzC2yK

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

127.0.0.1:6703

147.185.221.21:4449

147.185.221.21:6703

Mutex

uiagdedifgkrgllefg

Attributes
  • delay

    1

  • install

    true

  • install_file

    dllhost.dat.exe

  • install_folder

    %AppData%

aes.plain
1
3WEsWyxcJKMfYRnSkShcCoR7rvOhUCgO

Targets

    • Target

      Client.exe

    • Size

      114KB

    • MD5

      29e928f1f16131ca36a3aae3467141de

    • SHA1

      9b586f0d13236c3280e5b7b3b592309b296d7fff

    • SHA256

      5e3758c19d761560431f8fd8302aa6d2061568cbed3dc0a20ad3d4f5da93a956

    • SHA512

      3f4ab2b645ec82c9899061973edb92bc4ef4ef3663603dea0de3a37447b8b94577e1357f398bef02f1ce94260f53f25387de72d872a055d7a9482b1f1b256314

    • SSDEEP

      3072:QUVcxhzVCiPMVSe9VdQsH1bf7ADzQL4KvYMC29TwaGwYSOeBY:QtCiPMVSaesVbUzaFzC2yK

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.