Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
new.bat
-
Size
23KB
-
Sample
240726-xawjvazhnc
-
MD5
88758bf0dbf323c08f0bb5771283d5d2
-
SHA1
3e382408a01c800e06f1d2664ffac0b2b99d409d
-
SHA256
636fecec1bb4c562a86e26adf09aae32e19ddbe24c89799491fe7c47eedd79f9
-
SHA512
edb5a939fac9364272b6e28a7f46a45370c670e937f10249091c88f9dad9bf1f8428f3a724465ceca841ad0222b3d5a11a117a29b3086a1755484fe30cca28a6
-
SSDEEP
96:PVx1FVnpYIa6IE5bhNVdy7qYVksVx7Sldj7hT/YS7qYVWx2GziMCEYf90YoL2dHv:L889mL1qcHIX7sPe7TM8cRA
Static task
static1
Behavioral task
behavioral1
Sample
new.bat
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
new.bat
Resource
win10-20240611-en
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
mvenommm.duckdns.org:8520
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
xworm
3.1
myxwrm.duckdns.org:8292
xwor3july.duckdns.org:9402
IQ8oqrUFcEpbYRXJ
-
install_file
USB.exe
Extracted
xworm
5.0
myxwrm5.duckdns.org:9390
kd50Z3vjeQUiB2gn
-
install_file
USB.exe
Extracted
asyncrat
0.5.7B
Default
yasynck642.duckdns.org:6745
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
asyncrat
Default
dhanachy.duckdns.org:7878
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
new.bat
-
Size
23KB
-
MD5
88758bf0dbf323c08f0bb5771283d5d2
-
SHA1
3e382408a01c800e06f1d2664ffac0b2b99d409d
-
SHA256
636fecec1bb4c562a86e26adf09aae32e19ddbe24c89799491fe7c47eedd79f9
-
SHA512
edb5a939fac9364272b6e28a7f46a45370c670e937f10249091c88f9dad9bf1f8428f3a724465ceca841ad0222b3d5a11a117a29b3086a1755484fe30cca28a6
-
SSDEEP
96:PVx1FVnpYIa6IE5bhNVdy7qYVksVx7Sldj7hT/YS7qYVWx2GziMCEYf90YoL2dHv:L889mL1qcHIX7sPe7TM8cRA
-
Detect Xworm Payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Async RAT payload
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-