Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

50% Pagame...bH.bat

windows7-x64

8

50% Pagame...bH.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04032025_1645_04032025_50PagamentoSchachGlobalSolutionsGmbH.rar

  • Size

    2.7MB

  • Sample

    250304-vkan1swmt5

  • MD5

    ee8c2a5436ea5e8ae277637e1071db5f

  • SHA1

    a29ae279fb66881eb7bccd25a1e7ae62ef2b953d

  • SHA256

    d2884d594874a6bf18b9312ec2d295a401e7f2ef669316979f039f075edf2bbf

  • SHA512

    59bcc53630ca78cba19db5438ccbaad9e1331a2be92aa40812832e195e725d422c0b243a0e0f29c9c738077f6637a7ef5b99028fe103ff2f0e53a0d62fd41866

  • SSDEEP

    49152:nwwIEveVET3kpUxmTTx8R2DzSjkt5u8Gcww3TycvTj9qhIN3/rklykzzzROVVrt:nj5kpLTFJPYOscr3dP+IN3/AlycUH

Score
10/10
asyncratvenomratfeb 27 logsdiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

FEB 27 LOGS

Mutex

dwjsrlleihmlidl

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/i3NzmwEg

aes.plain

Targets

    • Target

      50% Pagamento Schach Global Solutions GmbH.bat

    • Size

      88KB

    • MD5

      3f4a7c3e31a629c3cd5d60662328355f

    • SHA1

      7200ca1b3f21067c5fef0b8a17743f8acd70e3e3

    • SHA256

      b35c3753b2dbf5ed4d04908d96b60d6bcdb763bd7eef2b7b511b4ce2f3baba13

    • SHA512

      489ee82ecbd174be71c7034a2e96a772e34b0febe2948dc3004440fc9649eaa8d07612eceb09c7ffb4f38885c76ac7e7a53538bccb3d9624568a2e52959f3b5a

    • SSDEEP

      1536:/uEJiEZkbmEKUgXEXzICKUnF9hwv5gZetCK+uK/egLsN/tdG76SwrqhvdrFy9UPk:/RJipHfPhwvMGTPKnAD2eqhhJPk

    Score
    10/10
    discoveryexecutionasyncratvenomratfeb 27 logsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks