Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10ANDROID_RAT.rar
windows7-x64
3ANDROID_RAT.rar
windows10-2004-x64
3ANDROID RA... 1.exe
windows7-x64
7ANDROID RA... 1.exe
windows10-2004-x64
7Creal.pyc
windows7-x64
3Creal.pyc
windows10-2004-x64
3ANDROID RA...er.exe
windows7-x64
7ANDROID RA...er.exe
windows10-2004-x64
7Creal.pyc
windows7-x64
3Creal.pyc
windows10-2004-x64
3ANDROID RA...me.txt
windows7-x64
1ANDROID RA...me.txt
windows10-2004-x64
1ANDROID RA...st.bat
windows7-x64
1ANDROID RA...st.bat
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 07:53
Behavioral task
behavioral1
Sample
ANDROID_RAT.rar
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ANDROID_RAT.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
ANDROID RAT/Build 1.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
ANDROID RAT/Build 1.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Creal.pyc
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Creal.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
ANDROID RAT/Compiler.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
ANDROID RAT/Compiler.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Creal.pyc
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Creal.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
ANDROID RAT/Readme.txt
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
ANDROID RAT/Readme.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
ANDROID RAT/Run first.bat
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
ANDROID RAT/Run first.bat
Resource
win10v2004-20240709-en
General
-
Target
ANDROID_RAT.rar
-
Size
15.8MB
-
MD5
f121b24292ab6b5c0fdc6f165f7e869d
-
SHA1
f5a34d026d56262ddf99b8099706d0c774b3cfb7
-
SHA256
8a78fdf56fe352e39b804faa5f544db35694ea6d0d46297d52bb66986604ab15
-
SHA512
954647af0d46b744073e642e84b91440e864c2e185ce7a1455360dc3d0065066fe9a99fe13684ad45658e871aa0ff485c43488b94c0b2d5bf4e6de97e172bd36
-
SSDEEP
393216:JKSn4hsYBCxVv2A6VbjSKgtB2WFVCHKSn4hsYBCxVv2A6VbjSKgtB2WFVCZ:JX+sYcVvf6VjSltxCHX+sYcVvf6VjSlQ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2580 2700 cmd.exe 31 PID 2700 wrote to memory of 2580 2700 cmd.exe 31 PID 2700 wrote to memory of 2580 2700 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ANDROID_RAT.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ANDROID_RAT.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2580
-