Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

DHL-INVOIC...09.vbs

windows7-x64

8

DHL-INVOIC...09.vbs

windows10-2004-x64

10

Damage Picture 1.vbs

windows7-x64

8

Damage Picture 1.vbs

windows10-2004-x64

10

Damage Picture 2.vbs

windows7-x64

8

Damage Picture 2.vbs

windows10-2004-x64

10

Damage Picture 3.vbs

windows7-x64

8

Damage Picture 3.vbs

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHLINVOICEdamagedproductpictures.vhd

  • Size

    9.0MB

  • Sample

    250307-nzcctszqw9

  • MD5

    e1b953bc3b5604f09002c1b608e1fb65

  • SHA1

    ba56a49bc0e6f962baaf14d9f7735fec4d84d306

  • SHA256

    15bebd4f7e43add41443b28becd68ee0bd7146a721be2eb0ed99cf89cd4ca5d6

  • SHA512

    77426426e508bdd02393a0a3bb3ee3bc99716396b8d30493efc17b5817a1773eb3c47cb3168ab31c1b87a0aebc001480205efc37dbb97c0f3c256ffcc25d8881

  • SSDEEP

    12288:zUDuH/c85GfjVoqH+5aGfjVoqH+5aGfjVoqH+5vGfjVoqH+5:zbH/v5kXeakXeakXevkXe

Score
10/10
asyncratvenomratmarch logsdiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

MARCH LOGS

Mutex

twgsnmvpigkpbmcqqk

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/93hjERwM

aes.plain

Targets

    • Target

      DHL-INVOICE_10094519030720250009.vbs

    • Size

      98KB

    • MD5

      33e243596a995b134c3862d2746d3a3a

    • SHA1

      dc51212190c79cd89cfb6a629e3f7299673fa003

    • SHA256

      d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259

    • SHA512

      545089424ea61e9c3871a75170d8695331bd991bf7fe8d10a5dd9a136db8b2015f9083faf86023c751550a9faa44ceb6ebfe5b6ae2d593d4261678eaa5a739c5

    • SSDEEP

      1536:PxfjFMLSEGgcX4XTA66MrhZLVzsBjuBl6D584BuvQNkHGwhJiz1U8x8x0yCzkIXG:PxGfjjLVzsBKB+uvNHTAaw8CyWVG

    Score
    10/10
    discoveryexecutionasyncratvenomratmarch logsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

    • Target

      Damage Picture 1.vbs

    • Size

      98KB

    • MD5

      33e243596a995b134c3862d2746d3a3a

    • SHA1

      dc51212190c79cd89cfb6a629e3f7299673fa003

    • SHA256

      d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259

    • SHA512

      545089424ea61e9c3871a75170d8695331bd991bf7fe8d10a5dd9a136db8b2015f9083faf86023c751550a9faa44ceb6ebfe5b6ae2d593d4261678eaa5a739c5

    • SSDEEP

      1536:PxfjFMLSEGgcX4XTA66MrhZLVzsBjuBl6D584BuvQNkHGwhJiz1U8x8x0yCzkIXG:PxGfjjLVzsBKB+uvNHTAaw8CyWVG

    Score
    10/10
    discoveryexecutionasyncratvenomratmarch logsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral3behavioral4

    • Target

      Damage Picture 2.vbs

    • Size

      98KB

    • MD5

      33e243596a995b134c3862d2746d3a3a

    • SHA1

      dc51212190c79cd89cfb6a629e3f7299673fa003

    • SHA256

      d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259

    • SHA512

      545089424ea61e9c3871a75170d8695331bd991bf7fe8d10a5dd9a136db8b2015f9083faf86023c751550a9faa44ceb6ebfe5b6ae2d593d4261678eaa5a739c5

    • SSDEEP

      1536:PxfjFMLSEGgcX4XTA66MrhZLVzsBjuBl6D584BuvQNkHGwhJiz1U8x8x0yCzkIXG:PxGfjjLVzsBKB+uvNHTAaw8CyWVG

    Score
    10/10
    discoveryexecutionasyncratvenomratmarch logsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral5behavioral6

    • Target

      Damage Picture 3.vbs

    • Size

      98KB

    • MD5

      33e243596a995b134c3862d2746d3a3a

    • SHA1

      dc51212190c79cd89cfb6a629e3f7299673fa003

    • SHA256

      d28c3371542ec4275020001c02ae26f41d0a11109375cffee6d22f56b9fc5259

    • SHA512

      545089424ea61e9c3871a75170d8695331bd991bf7fe8d10a5dd9a136db8b2015f9083faf86023c751550a9faa44ceb6ebfe5b6ae2d593d4261678eaa5a739c5

    • SSDEEP

      1536:PxfjFMLSEGgcX4XTA66MrhZLVzsBjuBl6D584BuvQNkHGwhJiz1U8x8x0yCzkIXG:PxGfjjLVzsBKB+uvNHTAaw8CyWVG

    Score
    10/10
    discoveryexecutionasyncratvenomratmarch logsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral7behavioral8

MITRE ATT&CK Enterprise v15

Tasks