Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    WaveInstaller.exe

  • Size

    249KB

  • Sample

    240711-pt8draygma

  • MD5

    b8a6cc953ead13dabfef6854bfe65139

  • SHA1

    51aaa0723d5d22c74c15f625e12662bf4aa2cfb7

  • SHA256

    4f9494cf61c3c10656a3f8eed5798ab604c815c34472c42c18b49656fb71d73e

  • SHA512

    9e7078acb76dd33b0811990b03b7e576eaedb75f13ba38f7c6457956d8c211231e86b02a6280e8dfa858b175003061867b0938e96efc7f9a2627d023983b3257

  • SSDEEP

    3072:G1NvtzbxNdSuLAsNeDF5nI0PGIj9lua/Obw0hFv2PCWpIdNrY:GTFzbPdt0sNOBTunbw0/5Wpi

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

https://ooo.fluffiflower.xyz/:8848

ooo.fluffiflower.xyz:8848

2.132.191.110:8848

0.0.0.0:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    true

  • install_file

    Explorer.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      WaveInstaller.exe

    • Size

      249KB

    • MD5

      b8a6cc953ead13dabfef6854bfe65139

    • SHA1

      51aaa0723d5d22c74c15f625e12662bf4aa2cfb7

    • SHA256

      4f9494cf61c3c10656a3f8eed5798ab604c815c34472c42c18b49656fb71d73e

    • SHA512

      9e7078acb76dd33b0811990b03b7e576eaedb75f13ba38f7c6457956d8c211231e86b02a6280e8dfa858b175003061867b0938e96efc7f9a2627d023983b3257

    • SSDEEP

      3072:G1NvtzbxNdSuLAsNeDF5nI0PGIj9lua/Obw0hFv2PCWpIdNrY:GTFzbPdt0sNOBTunbw0/5Wpi

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Renames multiple (6066) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks