Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Client.exe

  • Size

    74KB

  • Sample

    250309-rcmrtssvex

  • MD5

    4e2acf8511bdcd56d450a268402b1ae5

  • SHA1

    c9ffe8dd722fdc7611b3bfc45c327e0a051fbae4

  • SHA256

    66e1df37517d3363193b4a7adde2326877bc327c27bed5b2f7df5150346c2e25

  • SHA512

    3dc322b8c2af84db309158198098a15a8cf9e5bc98c1c7da2dae2aad3b3a2ce434bc1edb4008707b8f5980e2978cc938f731d89043d456e7d59e5befdcd8ffdd

  • SSDEEP

    1536:rU5ccx4y3lCl6PMVOe9VdQuDI6H1bf/eluQzcfjVclN:rU6cx4yVy6PMVOe9VdQsH1bfWluQqJY

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

127.0.0.1:4448

103.83.164.33:4449

103.83.164.33:4448

192.168.126.128:4449

192.168.126.128:4448

Mutex

iyziqtacatvjvjj

Attributes
  • delay

    1

  • install

    true

  • install_file

    hello.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Client.exe

    • Size

      74KB

    • MD5

      4e2acf8511bdcd56d450a268402b1ae5

    • SHA1

      c9ffe8dd722fdc7611b3bfc45c327e0a051fbae4

    • SHA256

      66e1df37517d3363193b4a7adde2326877bc327c27bed5b2f7df5150346c2e25

    • SHA512

      3dc322b8c2af84db309158198098a15a8cf9e5bc98c1c7da2dae2aad3b3a2ce434bc1edb4008707b8f5980e2978cc938f731d89043d456e7d59e5befdcd8ffdd

    • SSDEEP

      1536:rU5ccx4y3lCl6PMVOe9VdQuDI6H1bf/eluQzcfjVclN:rU6cx4yVy6PMVOe9VdQsH1bfWluQqJY

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks