Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ba357d25a91a07eb86e1412b47aa9e64b55c1b9bec4900d25726d615555d76b0

  • Size

    276KB

  • Sample

    240818-ej3qeatgqd

  • MD5

    c7a0b1673cefe5ade7f9d5f96bd4bc85

  • SHA1

    cd0a62a731f1e4c104d214164035950d274762d9

  • SHA256

    ba357d25a91a07eb86e1412b47aa9e64b55c1b9bec4900d25726d615555d76b0

  • SHA512

    ca706565e19b4209b78915d4489fc61ba77dc8d049f52ae02a8918534462471a01c25dfafd8c92fc4b5570830368d0d2f8ce726a7def5878ced7725f199afbfd

  • SSDEEP

    768:uLFXd/g9buJS+3RrP8ftYY5l4LyM2jWbGvhjpZpfeN2:eFXd/g9buMWz8fCY74LD2jWavjZpfeN

Malware Config

Extracted

Family

asyncrat

Version

| Edit by Vinom Rat

Botnet

8/4/2004

C2

luxeloot.info:2005

Mutex

AsyncMutex_345JNFV3c

Attributes
  • delay

    3

  • install

    false

  • install_file

    ANON.EXE.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ba357d25a91a07eb86e1412b47aa9e64b55c1b9bec4900d25726d615555d76b0

    • Size

      276KB

    • MD5

      c7a0b1673cefe5ade7f9d5f96bd4bc85

    • SHA1

      cd0a62a731f1e4c104d214164035950d274762d9

    • SHA256

      ba357d25a91a07eb86e1412b47aa9e64b55c1b9bec4900d25726d615555d76b0

    • SHA512

      ca706565e19b4209b78915d4489fc61ba77dc8d049f52ae02a8918534462471a01c25dfafd8c92fc4b5570830368d0d2f8ce726a7def5878ced7725f199afbfd

    • SSDEEP

      768:uLFXd/g9buJS+3RrP8ftYY5l4LyM2jWbGvhjpZpfeN2:eFXd/g9buMWz8fCY74LD2jWavjZpfeN

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks