Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1e75965d3ec1943db598d2a214ec7c58c1dc3bc88053c6a0545d087e5f009edc.zip

  • Size

    317KB

  • Sample

    250325-nf634avxey

  • MD5

    ede9242ea89ee1b4f883417bb3571935

  • SHA1

    799eb19aa107606f2ac443a7e04b42f44b6e2dcc

  • SHA256

    1e75965d3ec1943db598d2a214ec7c58c1dc3bc88053c6a0545d087e5f009edc

  • SHA512

    269e1861514b3b2015bcd9ee318c9d9a5f74e79dfc821ae8ef6acbbd3ace9a1a7be70ffbf40ef91c6f2f1a26408fa9e7ba5e3cbceb18c7c99fb71fd3a86da906

  • SSDEEP

    6144:hnDsLYl1KU0oYs/FWraMF9sbPu46CHFLPriiyAVjuF:hkYl/T6rB0PHlLPUF

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

Default

C2

whatgodcannotdodoestnotexist.duckdns.org:20905

Mutex

rqivnkwojys

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      PO 6300019918..exe

    • Size

      750KB

    • MD5

      66645e2b85084bf859e244ca2d6ff0cc

    • SHA1

      37fae7b3c6c4d0acb4b1001f47f906fc24a97d98

    • SHA256

      cc56266bc176fcf13629cec7f6290c6bd62fe2a47f202f28daf6152438b28a5b

    • SHA512

      77a9b9ec7138c467e69f42378641f986ef868fabc3e37a25ff4f3ba0636cba9ae696606b4f287b8577ee30ff2c5c5d0447e9ca05592b28fad1a1541bc9c07f79

    • SSDEEP

      12288:cAI0QiIQEJgDkWyMzShD6vPS0IyacFA/5bgO72lso2w6aX6gO1Mio:cAPs1JgoWBYDOU7hbga2rPXtT

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks