Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2025, 13:04

250312-qa6aqa1thy 10

12/03/2025, 12:57

250312-p6x4jssmx9 10

12/03/2025, 12:45

250312-pzgg8az1dw 10

General

  • Target

    ADFoyxP.exe

  • Size

    3.5MB

  • Sample

    250312-qa6aqa1thy

  • MD5

    45c1abfb717e3ef5223be0bfc51df2de

  • SHA1

    4c074ea54a1749bf1e387f611dea0d940deea803

  • SHA256

    b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243

  • SHA512

    3d667f5ada9b62706be003ba42c4390177fc47c82d1d9fa9eaca36e36422e77b894f5ec92ad7a143b7494a5a4b43d6eb8af91cb54e78984bb6e8350df5c34546

  • SSDEEP

    98304:UePnIk+fZcURguwJaPquzFJi0E3znjVxkC2b4VbD:LfIzRtguwgqo5E33wIVbD

Malware Config

Targets

    • Target

      ADFoyxP.exe

    • Size

      3.5MB

    • MD5

      45c1abfb717e3ef5223be0bfc51df2de

    • SHA1

      4c074ea54a1749bf1e387f611dea0d940deea803

    • SHA256

      b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243

    • SHA512

      3d667f5ada9b62706be003ba42c4390177fc47c82d1d9fa9eaca36e36422e77b894f5ec92ad7a143b7494a5a4b43d6eb8af91cb54e78984bb6e8350df5c34546

    • SSDEEP

      98304:UePnIk+fZcURguwJaPquzFJi0E3znjVxkC2b4VbD:LfIzRtguwgqo5E33wIVbD

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • Stormkitty family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Drops startup file

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks