Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4.exe

  • Size

    585KB

  • Sample

    240801-cbv99azfla

  • MD5

    25dbcf1fe03ad12511191f54bff57d76

  • SHA1

    b748178f5756712162edec1e85fa6e0a456bc722

  • SHA256

    b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4

  • SHA512

    ecdc722f18d81fbd0dbd164b6bdfec25fa2c3b3bbc3305f2a8c092b4e0607932c2ee0303a3bbadc6f38ff74b406444f1b401d7822727f66fe139796cad13d722

  • SSDEEP

    6144:9YZmun4mCYZWNfg2IJHCRrtDWZALTgvLP1fB+toSUMqQGc8oYTvQ4d8Kmk/5p3:9sAlgrVwZaeTgvp4oSUMqK0Q4dtm

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

AMU

C2

jnmanymen.ydns.eu:1470

Mutex

Y9Lj8dOJExpn

Attributes
  • delay

    10

  • install

    true

  • install_file

    windows.exe

  • install_folder

    %AppData%

aes.plain
1
LddZSTncEddglm7lm3NvXdVwS3HiU8Vs

Targets

    • Target

      b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4.exe

    • Size

      585KB

    • MD5

      25dbcf1fe03ad12511191f54bff57d76

    • SHA1

      b748178f5756712162edec1e85fa6e0a456bc722

    • SHA256

      b5522fb2683e7ff30d329d6d7afd7b5eca7b60d581757476bda4925f8f10ddb4

    • SHA512

      ecdc722f18d81fbd0dbd164b6bdfec25fa2c3b3bbc3305f2a8c092b4e0607932c2ee0303a3bbadc6f38ff74b406444f1b401d7822727f66fe139796cad13d722

    • SSDEEP

      6144:9YZmun4mCYZWNfg2IJHCRrtDWZALTgvLP1fB+toSUMqQGc8oYTvQ4d8Kmk/5p3:9sAlgrVwZaeTgvp4oSUMqK0Q4dtm

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.