Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20240708-en
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
26e9b2f985b2680cf1a1881bd5e23b4e
-
SHA1
8af6aa09c15ac2947666a6f8778f75da4bfbcb1c
-
SHA256
de3e68021cc2c807e4c0297ab277396acd8a8939031bab33a7b72323b90f3f81
-
SHA512
964803e4a82111ee7fd3648b9fc1d3d3260a43f2282d27ed4789f90060a8f240bece4712ee9c74004a5b7b1bd91fbce90c13709269d3e07b27c360e039aef7da
-
SSDEEP
768:KuETKT0k3qXWUrV6e1mo2qyIQKjPGaG6PIyzjbFgX3ilHt7MPbCiMGYkZaOwpo4+:KuETKT0cE2/1KTkDy3bCXSRt7AmGYmau
Malware Config
Extracted
asyncrat
0.5.8
realxworm
147.185.221.20:9835
147.185.221.20:18563
eCCoCTFPGVfF
-
delay
3
-
install
true
-
install_file
ToiletRizz.exe
-
install_folder
%AppData%
Signatures
Files
-
AsyncClient.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ