Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

archive.rar

windows11-21h2-x64

10

Resubmissions

11/03/2025, 16:25

250311-txbamsxq12 10

10/03/2025, 16:59

250310-vhtzwastaz 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    archive.rar

  • Size

    11.6MB

  • MD5

    88f853c79f8978c740a39b6ffeafdde3

  • SHA1

    2f142b3c96ef3b8d6b7705055a504fd0d4ed66a1

  • SHA256

    1ab7fef81e4a5325f70a7eb8f1e551edaa6344d16eb1aeca68974d89bb4e40db

  • SHA512

    fb3fc9b6b1e35dc812b2e328c46e177da57649be2679f02fc02addcf1f552aeb2dac5f900b4eb0cfbdfba2c8c378ba340882f9b32a016caedbc87b6c594dce8c

  • SSDEEP

    196608:/q710W0isAdLeCKHnNUdTp5S4OhUIyFaEkFNEDMYaHUgRhBJwYpSOc0VsG:AfdyTHN6pdZIyIXGDMN3jTprZ

Score
10/10
pyinstallerratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

2.58.56.179:2035

Mutex

r4ttlesn4ke_ufog3f8u3egef978

Attributes
  • delay

    1

  • install

    true

  • install_file

    Chrome.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • archive.rar
    .rar

    Password: test

  • cdnmain/Exela.exe
    .exe windows:6 windows x64 arch:x64

    Password: test

    72c4e339b7af8ab1ed2eb3821c98713a


    Headers

    Imports

    Sections

  • Stub.pyc
  • cdnmain/chrome.exe
    .exe windows:4 windows x86 arch:x86

    Password: test

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • cdnmain/cloudflare_whitelist.exe
    .exe windows:6 windows x64 arch:x64

    Password: test

    bc6e49796b8edbf82682ce0ac34e6d0c


    Headers

    Imports

    Sections

  • cdnmain/ef.exe
    .exe windows:4 windows x86 arch:x86

    Password: test

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • cdnmain/libsodium.dll
    .dll windows:6 windows x64 arch:x64

    Password: test

    7a6117b38d629a5e51517a131e884e3d


    Headers

    Imports

    Exports

    Sections

  • cdnmain/sqlite3.dll
    .dll windows:6 windows x64 arch:x64

    Password: test

    cdf1f463b4a3124ff8185a919606e61d


    Headers

    Imports

    Exports

    Sections

  • cdnmain/vcruntime140.dll
    .dll windows:6 windows x64 arch:x64

    Password: test

    7f91c705cf579114968b3edc12e1175e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • cdnmain/verif.exe
    .exe windows:6 windows x64 arch:x64

    Password: test

    d057a3b2cb6d2ee5f17253f18ea906f4


    Headers

    Imports

    Sections