Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2025-03-13_2ede82a123e390c6a72bc3a4a67d0d73_frostygoop_luca-stealer_snatch

  • Size

    2.1MB

  • Sample

    250313-rwq9csxnx9

  • MD5

    2ede82a123e390c6a72bc3a4a67d0d73

  • SHA1

    37e16977cb8be7aa61acc85bf54d0d782cdf5ad2

  • SHA256

    7e8601d905551e209f24ebcdc3056f81c986bd58fad78cd0962147e1f5a3289a

  • SHA512

    3cf92ef761bc2eaddddbded81df4a112bf1981cdde475aa7a863f0b27c2e13a6b52f44156092d613d6de78222b3ffd894f7f29fd00604ecb9d71dc45ac6a3478

  • SSDEEP

    24576:07qijrQXIU4dP3n/jx3RL/7XGpDEuXwJ0LeF4/xwukFFmBchFmN2nvC:SBMXIU4dfn/jx3RLTXuDEu2F49QW2n

Malware Config

Extracted

Family

asyncrat

Version

Alfa Red Fox V1

Botnet

qoba

C2

45.15.156.15:3000

Mutex

wbxzbmxwrei

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      2025-03-13_2ede82a123e390c6a72bc3a4a67d0d73_frostygoop_luca-stealer_snatch

    • Size

      2.1MB

    • MD5

      2ede82a123e390c6a72bc3a4a67d0d73

    • SHA1

      37e16977cb8be7aa61acc85bf54d0d782cdf5ad2

    • SHA256

      7e8601d905551e209f24ebcdc3056f81c986bd58fad78cd0962147e1f5a3289a

    • SHA512

      3cf92ef761bc2eaddddbded81df4a112bf1981cdde475aa7a863f0b27c2e13a6b52f44156092d613d6de78222b3ffd894f7f29fd00604ecb9d71dc45ac6a3478

    • SSDEEP

      24576:07qijrQXIU4dP3n/jx3RL/7XGpDEuXwJ0LeF4/xwukFFmBchFmN2nvC:SBMXIU4dfn/jx3RLTXuDEu2F49QW2n

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks