Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    updater.exe

  • Size

    232KB

  • Sample

    240930-xrgr1szhrr

  • MD5

    50e5f40aee9ed03617394cda8ecc0f4e

  • SHA1

    f79e10da26389e629c0d52ed2a4ad4755c161a1f

  • SHA256

    3d454f7a59c5b36847a8a92812bb57202bf77b800d9b4aa1d67f9c28614a5afa

  • SHA512

    59988efb8d98297c33d329aa5af1ca8c36a22c68da9bd19b18c16ef75ca2cd2aca02a566e5330f9d6c1f89c466ada25406ad366e2be7447eacfe1324bb226b83

  • SSDEEP

    6144:cDubaBBOBIIj6HLLYLCYJqvc1D6L/qfNNHbgESNLspaGr4ZyHOnxFL:9ba5LmLcEUwYGAyHcb

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6895317243:AAGYnSkZaitamccrc-RF7hCkwovAyRn5CjQ/sendMessage?chat_id=1787677484

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
e5XY2RlmFUzlc1QQrE43aajUjonZEtT4

Targets

    • Target

      updater.exe

    • Size

      232KB

    • MD5

      50e5f40aee9ed03617394cda8ecc0f4e

    • SHA1

      f79e10da26389e629c0d52ed2a4ad4755c161a1f

    • SHA256

      3d454f7a59c5b36847a8a92812bb57202bf77b800d9b4aa1d67f9c28614a5afa

    • SHA512

      59988efb8d98297c33d329aa5af1ca8c36a22c68da9bd19b18c16ef75ca2cd2aca02a566e5330f9d6c1f89c466ada25406ad366e2be7447eacfe1324bb226b83

    • SSDEEP

      6144:cDubaBBOBIIj6HLLYLCYJqvc1D6L/qfNNHbgESNLspaGr4ZyHOnxFL:9ba5LmLcEUwYGAyHcb

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Looks up geolocation information via web service

      Uses a legitimate geolocation service to find the infected system's geolocation info.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.