Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7697ebe5ea4766b1653f58aa24327679b35fa917877568238ac306a913289b40

  • Size

    502KB

  • Sample

    221122-jc9btseb32

  • MD5

    16db55265ceb495867c35c68a1b672ab

  • SHA1

    1b18cb285e91c3f9c78f4f3a18a8baf5df6b6fc4

  • SHA256

    7697ebe5ea4766b1653f58aa24327679b35fa917877568238ac306a913289b40

  • SHA512

    bc4dde6ef69c606753d05fd303b0385d5dec303ce2b399de37e29dd2c085c53e47309381f34b503f87d27a66420c1c21ba8c98c81490c3614f679b8bfc034a6d

  • SSDEEP

    6144:MTEgdc0Y5ebGbXOsA6j1RdhQA3CpXJ9J6jFivvvcE6Ob8F9ogRXOc0UblHcTR36:MTEgdfYhA6bGqKKpNeYlHcd6

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

eggsbenedict.onthewifi.com:2448

Mutex

047fff9d-5ae7-4a17-a172-45ccd40ba62f

Attributes
  • encryption_key

    28D26D97888ABDC848F4C65C4EE630CCEF1C1B67

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      7697ebe5ea4766b1653f58aa24327679b35fa917877568238ac306a913289b40

    • Size

      502KB

    • MD5

      16db55265ceb495867c35c68a1b672ab

    • SHA1

      1b18cb285e91c3f9c78f4f3a18a8baf5df6b6fc4

    • SHA256

      7697ebe5ea4766b1653f58aa24327679b35fa917877568238ac306a913289b40

    • SHA512

      bc4dde6ef69c606753d05fd303b0385d5dec303ce2b399de37e29dd2c085c53e47309381f34b503f87d27a66420c1c21ba8c98c81490c3614f679b8bfc034a6d

    • SSDEEP

      6144:MTEgdc0Y5ebGbXOsA6j1RdhQA3CpXJ9J6jFivvvcE6Ob8F9ogRXOc0UblHcTR36:MTEgdfYhA6bGqKKpNeYlHcd6

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks