Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/12/2024, 20:45

241227-zjry5azmbl 4

27/12/2024, 15:46

241227-s7r6gaxjcr 10

General

  • Target

    https://github.com/DieFrikadelle/my-priv.-RAT-collection/tree/main/Liberium%202.1

  • Sample

    241227-s7r6gaxjcr

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

GitHub

C2

127.0.0.1:10000

127.0.0.1:650

domain13.ddns.net:10000

domain13.ddns.net:650

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

GitHub

C2

domain13.ddns.net:650

Mutex

21b27c61-8944-4615-8ab6-b84be8f39d71

Attributes
  • encryption_key

    845C5D60A275826BC650C718626063CA6657034B

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchost.exe

  • subdirectory

    java JDK 8

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

mer)/bjvoerf&%cwno

Attributes
  • delay

    1

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

  • pastebin_config

    https://pastebin.com/raw/q6cqRVgM

aes.plain

Targets

    • Target

      https://github.com/DieFrikadelle/my-priv.-RAT-collection/tree/main/Liberium%202.1

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Async RAT payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

MITRE ATT&CK Enterprise v15

Tasks