Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    23945d9be12e6b34aae896ef68d098f922b1f972e3d85f499d322192187fd6d2.exe

  • Size

    65KB

  • Sample

    250313-cllhsssmx8

  • MD5

    2d928d57b8ff1b3414001e22475a45fd

  • SHA1

    b1ea8a4f0c33a171a1febadb6eaae73994ac40c6

  • SHA256

    23945d9be12e6b34aae896ef68d098f922b1f972e3d85f499d322192187fd6d2

  • SHA512

    740270e15358f340c1f906451d19477cfa6f5a65410c53e2838f9ea58df0d0a0ee54f7c708970aa6eebdaafc06042e7889d97eb886bc36cb5935bc118ce7b9b4

  • SSDEEP

    1536:E2oSDFekWFGc0rOkZr0LP+OCgwPsE8HU6aKwUVQ0ywjbdJ2Ycs+RDZNpl6I2re3B:E2oSZeklsE8HU6aKXVQ0dbdJN+lz6o3x

Malware Config

Extracted

Family

asyncrat

Version

Xchallenger | 3Losh

Botnet

1

C2

207.231.111.146:7707

207.231.111.146:8808

207.231.111.146:0077

207.231.111.146:0007

207.231.111.146:6666

207.231.111.146:7777

207.231.111.146:1996

207.231.111.146:2106

Mutex

AsyncMutex_43520e43afs

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      23945d9be12e6b34aae896ef68d098f922b1f972e3d85f499d322192187fd6d2.exe

    • Size

      65KB

    • MD5

      2d928d57b8ff1b3414001e22475a45fd

    • SHA1

      b1ea8a4f0c33a171a1febadb6eaae73994ac40c6

    • SHA256

      23945d9be12e6b34aae896ef68d098f922b1f972e3d85f499d322192187fd6d2

    • SHA512

      740270e15358f340c1f906451d19477cfa6f5a65410c53e2838f9ea58df0d0a0ee54f7c708970aa6eebdaafc06042e7889d97eb886bc36cb5935bc118ce7b9b4

    • SSDEEP

      1536:E2oSDFekWFGc0rOkZr0LP+OCgwPsE8HU6aKwUVQ0ywjbdJ2Ycs+RDZNpl6I2re3B:E2oSZeklsE8HU6aKXVQ0dbdJN+lz6o3x

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks