Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Microsoft Update.exe

  • Size

    163KB

  • Sample

    240712-cg9d3awgpc

  • MD5

    39ec49dbf7fb74a21606065f713cd881

  • SHA1

    9ddaedd9c820b2fad1534a65bed5d61611838468

  • SHA256

    b834c4796e9073fcf3e9eccfa7034b26fc0ea94783ce111221a6b44f9e015e14

  • SHA512

    12d24d9a79b882d4d54e42eca8673c6d78de7e6800d77ea5535deeeafa7448c0525bba767e69c1755dd36258724d7d583d121b0e9e97590925d5772f59e2f96f

  • SSDEEP

    3072:LT3+nIM6gSYrHu9YwlIlvrg7evv3QOAQ9Be5BV0WUniyimyk:WngVik7evv3QO99Be5v0WURy

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Discord

C2

181.47.208.50:4449

Mutex

yqhbuwfankgiktwqwmr

Attributes
  • delay

    1

  • install

    true

  • install_file

    Microsoft Update.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Microsoft Update.exe

    • Size

      163KB

    • MD5

      39ec49dbf7fb74a21606065f713cd881

    • SHA1

      9ddaedd9c820b2fad1534a65bed5d61611838468

    • SHA256

      b834c4796e9073fcf3e9eccfa7034b26fc0ea94783ce111221a6b44f9e015e14

    • SHA512

      12d24d9a79b882d4d54e42eca8673c6d78de7e6800d77ea5535deeeafa7448c0525bba767e69c1755dd36258724d7d583d121b0e9e97590925d5772f59e2f96f

    • SSDEEP

      3072:LT3+nIM6gSYrHu9YwlIlvrg7evv3QOAQ9Be5BV0WUniyimyk:WngVik7evv3QO99Be5v0WURy

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks