Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Client.exe
-
Size
75KB
-
MD5
43b633deb84a4792b739991c7c0eed5e
-
SHA1
bcb1ce91f6607d0d3463ad8d2892f9bafd50cc9b
-
SHA256
71bde6a14a0325175e54881e2a53c67d5c616044879ac2dca58c3082b607f106
-
SHA512
dbbf0f604b4e4bad82b91939e6e9bc628210390cd9370a69507e8d028cdc7762442f544860887e94d9455a8de3124ab005892012df210151c3764dcfa4055bf8
-
SSDEEP
1536:/U0AcxOIWC72PMV+e9VdQkhDIyH1bf/oe2PQzcYYVclNJ:/URcxONo2PMV+e9VdQgH1bfqQpiYH
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
gloybcuraseumeqtizz
-
delay
1
-
install
false
-
install_folder
%Temp%
Signatures
-
Asyncrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ