Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
04/12/2024, 12:30 UTC
General
-
Target
skikda.exe
-
Size
256KB
-
MD5
6c366d318dca314f30309b648776cee9
-
SHA1
e2cfbf16cf16ecda3297b71d9622b45daf52660a
-
SHA256
1c5db3ae8ccc55502a6f27661de3d86ff5c48eb1b7ab97448efd6c3eaad1bc36
-
SHA512
5eb743fad92f2dbfc3ef1a0a84d411e13d72f590fe87cdc0f588a595f95f063720d6d2d3a6b43d2a38a5e0f759a1e296c35dc9a235361f08c0051b96fe78707b
-
SSDEEP
3072:uZ17XdQHAaG/W/acL8Uo2ZauJny4pW6KvcmzWRK9Wvmt/QetG/fU5h/QZ4d2BH4X:mXdFcL8rDI4KTRArG32/K4d8H4BEcWm
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
| Edit 3LOSH RAT
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
Mutex
MSF
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
1
FE4ARI35PwpCPxFTFwBbIwOk8sWNurgE
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Async RAT payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\skikda.exe"C:\Users\Admin\AppData\Local\Temp\skikda.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
- No results found
-
127.0.0.1:6606 -
127.0.0.1:7707
-
127.0.0.1:7707
-
127.0.0.1:8808
-
127.0.0.1:8808
-
127.0.0.1:6606
-
127.0.0.1:8808
-
127.0.0.1:6606
-
127.0.0.1:6606
-
127.0.0.1:8808
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:6606
-
127.0.0.1:7707
-
127.0.0.1:8808
-
127.0.0.1:7707
-
127.0.0.1:6606
-
127.0.0.1:8808
-
127.0.0.1:8808
-
127.0.0.1:6606
-
127.0.0.1:8808
-
127.0.0.1:8808
-
127.0.0.1:6606
-
127.0.0.1:6606
No results found
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
272KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
88KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB