Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bKJ7.exe
-
Size
348KB
-
Sample
230323-ckj9cach88
-
MD5
7f515d05fb17932adbbcbd0c2aba18f1
-
SHA1
9220c765e0dd0e7fa30af6823f3f382ef12a5dde
-
SHA256
39dd5339fa37de30a494a9995744facb01ed2ed446d8c2041d4817000ee8f357
-
SHA512
73e627f18d47eaa94151b40a4c3977985faef9196f78a070f22b1df61c5d849f549d81c1c57b48e17bb5b7544e650b21000aab307d8235f2f0486e2174a1d8f2
-
SSDEEP
6144:kg6bPXhLApfpvKhECGiwru41w8wbfb3EA+6sq5FLT4rN6:9mhApdKhEC8SOw8aQRCFLTo6
Behavioral task
behavioral1
Sample
bKJ7.exe
Resource
win7-20230220-en
Malware Config
Extracted
quasar
1.3.0.0
Office04
myhost88.ddns.net:4782
QSR_MUTEX_kTcfswfSj43R2vlOKd
-
encryption_key
QnUpxbEUVKL7JTeQ1Sc5
-
install_name
ms configs.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ms configs
-
subdirectory
SubDir
Targets
-
-
Target
bKJ7.exe
-
Size
348KB
-
MD5
7f515d05fb17932adbbcbd0c2aba18f1
-
SHA1
9220c765e0dd0e7fa30af6823f3f382ef12a5dde
-
SHA256
39dd5339fa37de30a494a9995744facb01ed2ed446d8c2041d4817000ee8f357
-
SHA512
73e627f18d47eaa94151b40a4c3977985faef9196f78a070f22b1df61c5d849f549d81c1c57b48e17bb5b7544e650b21000aab307d8235f2f0486e2174a1d8f2
-
SSDEEP
6144:kg6bPXhLApfpvKhECGiwru41w8wbfb3EA+6sq5FLT4rN6:9mhApdKhEC8SOw8aQRCFLTo6
-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-