Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

  • Size

    2.8MB

  • Sample

    221007-dj8e8abde7

  • MD5

    be30e02cf69f0b7fad05dfc7a641d903

  • SHA1

    dec2042f9e76557f59e80aefcd63465761b4dd61

  • SHA256

    93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

  • SHA512

    f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476

  • SSDEEP

    49152:cx/mZWE3x9nn0c1IYVuTRyjrk88RIP5vEUfl6za32ehyfT0m:cxeZWE3x9n0OIYV4Ryjrk88RI0

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

ProjectHydro

C2

192.168.145.131:4782

Mutex

959a4a81-1e0c-4b68-9700-ba2617f02c24

Attributes
  • encryption_key

    5314E4E479660AE215BEB448CBAF17EDF374B00B

  • install_name

    vc_redist.x64.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    VC redistributable install

  • subdirectory

    vc_redist

Targets

    • Target

      93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

    • Size

      2.8MB

    • MD5

      be30e02cf69f0b7fad05dfc7a641d903

    • SHA1

      dec2042f9e76557f59e80aefcd63465761b4dd61

    • SHA256

      93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33

    • SHA512

      f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476

    • SSDEEP

      49152:cx/mZWE3x9nn0c1IYVuTRyjrk88RIP5vEUfl6za32ehyfT0m:cxeZWE3x9n0OIYV4Ryjrk88RI0

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks