Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Client.exe
-
Size
74KB
-
Sample
250309-rcmrtssvex
-
MD5
4e2acf8511bdcd56d450a268402b1ae5
-
SHA1
c9ffe8dd722fdc7611b3bfc45c327e0a051fbae4
-
SHA256
66e1df37517d3363193b4a7adde2326877bc327c27bed5b2f7df5150346c2e25
-
SHA512
3dc322b8c2af84db309158198098a15a8cf9e5bc98c1c7da2dae2aad3b3a2ce434bc1edb4008707b8f5980e2978cc938f731d89043d456e7d59e5befdcd8ffdd
-
SSDEEP
1536:rU5ccx4y3lCl6PMVOe9VdQuDI6H1bf/eluQzcfjVclN:rU6cx4yVy6PMVOe9VdQsH1bfWluQqJY
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20240729-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
127.0.0.1:4448
103.83.164.33:4449
103.83.164.33:4448
192.168.126.128:4449
192.168.126.128:4448
iyziqtacatvjvjj
-
delay
1
-
install
true
-
install_file
hello.exe
-
install_folder
%AppData%
Targets
-
-
Target
Client.exe
-
Size
74KB
-
MD5
4e2acf8511bdcd56d450a268402b1ae5
-
SHA1
c9ffe8dd722fdc7611b3bfc45c327e0a051fbae4
-
SHA256
66e1df37517d3363193b4a7adde2326877bc327c27bed5b2f7df5150346c2e25
-
SHA512
3dc322b8c2af84db309158198098a15a8cf9e5bc98c1c7da2dae2aad3b3a2ce434bc1edb4008707b8f5980e2978cc938f731d89043d456e7d59e5befdcd8ffdd
-
SSDEEP
1536:rU5ccx4y3lCl6PMVOe9VdQuDI6H1bf/eluQzcfjVclN:rU6cx4yVy6PMVOe9VdQsH1bfWluQqJY
-
Asyncrat family
-
Venomrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-