Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10ANDROID_RAT.rar
windows7-x64
3ANDROID_RAT.rar
windows10-2004-x64
3ANDROID RA... 1.exe
windows7-x64
7ANDROID RA... 1.exe
windows10-2004-x64
7Creal.pyc
windows7-x64
3Creal.pyc
windows10-2004-x64
3ANDROID RA...er.exe
windows7-x64
7ANDROID RA...er.exe
windows10-2004-x64
7Creal.pyc
windows7-x64
3Creal.pyc
windows10-2004-x64
3ANDROID RA...me.txt
windows7-x64
1ANDROID RA...me.txt
windows10-2004-x64
1ANDROID RA...st.bat
windows7-x64
1ANDROID RA...st.bat
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 07:53
Behavioral task
behavioral1
Sample
ANDROID_RAT.rar
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ANDROID_RAT.rar
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
ANDROID RAT/Build 1.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
ANDROID RAT/Build 1.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Creal.pyc
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Creal.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
ANDROID RAT/Compiler.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
ANDROID RAT/Compiler.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
Creal.pyc
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
Creal.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
ANDROID RAT/Readme.txt
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
ANDROID RAT/Readme.txt
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
ANDROID RAT/Run first.bat
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
ANDROID RAT/Run first.bat
Resource
win10v2004-20240709-en
General
-
Target
Creal.pyc
-
Size
105KB
-
MD5
33c413274d516b542d7372f3b5d09eaf
-
SHA1
cad7903b7819be3e029c59b7b99de195d1f7ffcd
-
SHA256
e257b0f127b87920205378556cbdede58dd72064d73835f1c8335a930416a042
-
SHA512
7abcbb6472e30ed9fe31ca5aa08036c948d58983d2942b3b971fb76d62ee1c6effce16cd3c3246093f52cc14ecee2a641830751bdcca9d8cf6b5f1e43ba2876e
-
SSDEEP
1536:oSreO/J2vY5DA1y5ZvbZb8y0M5V49pCJlkpMkEQQU5Eyk7:oSCO/JYM3vbulrCJlki4j5Eyq
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2764 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2764 AcroRd32.exe 2764 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2248 1724 cmd.exe 31 PID 1724 wrote to memory of 2248 1724 cmd.exe 31 PID 1724 wrote to memory of 2248 1724 cmd.exe 31 PID 2248 wrote to memory of 2764 2248 rundll32.exe 32 PID 2248 wrote to memory of 2764 2248 rundll32.exe 32 PID 2248 wrote to memory of 2764 2248 rundll32.exe 32 PID 2248 wrote to memory of 2764 2248 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Creal.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ef84f98c1b1b27d3f91955f3884195c8
SHA1cc88c7375658e17c61f6cbd09df0e1b4615abc65
SHA2566efe6e816d6f43d180cffbac3a0df1954323e758ffd123c02e7cc3e92143bd05
SHA512b9f18da9120d15b3541bc009d8d5d2197d837c4ecf2eb4b4d7551ffe48b79de8ab495308e3f0c98b455dc3d7bc487e8994225d7f0a345eb45e60e9f87b885b9d