Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
-
Size
2.8MB
-
Sample
221007-dj8e8abde7
-
MD5
be30e02cf69f0b7fad05dfc7a641d903
-
SHA1
dec2042f9e76557f59e80aefcd63465761b4dd61
-
SHA256
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
-
SHA512
f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476
-
SSDEEP
49152:cx/mZWE3x9nn0c1IYVuTRyjrk88RIP5vEUfl6za32ehyfT0m:cxeZWE3x9n0OIYV4Ryjrk88RI0
Behavioral task
behavioral1
Sample
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
quasar
1.4.0
ProjectHydro
192.168.145.131:4782
959a4a81-1e0c-4b68-9700-ba2617f02c24
-
encryption_key
5314E4E479660AE215BEB448CBAF17EDF374B00B
-
install_name
vc_redist.x64.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
VC redistributable install
-
subdirectory
vc_redist
Targets
-
-
Target
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
-
Size
2.8MB
-
MD5
be30e02cf69f0b7fad05dfc7a641d903
-
SHA1
dec2042f9e76557f59e80aefcd63465761b4dd61
-
SHA256
93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
-
SHA512
f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476
-
SSDEEP
49152:cx/mZWE3x9nn0c1IYVuTRyjrk88RIP5vEUfl6za32ehyfT0m:cxeZWE3x9n0OIYV4Ryjrk88RI0
Score10/10-
Quasar payload
-
Executes dropped EXE
-