Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
16888128718a66611c1d86e12.datdecoded
-
Size
348KB
-
Sample
230709-m37sgacd69
-
MD5
7834a7e88c159e7f55934c740ca39935
-
SHA1
c5a4dcd4454df284e95472a972511c2488bd79ac
-
SHA256
b8eda4e9e691fe7017981cea833b63299ea6b89e08f3995b630cf705a393d16b
-
SHA512
2c3f4f70cb898eb6fafa60b8f55301ef4b3c1918c527bec6f8721c5146c4affef28bdabda991fdb799df78dc74d70af7d57989fb00dcb787e23a42ee851b4b7d
-
SSDEEP
6144:r2NHXf500MRWfu7waMmbUIgiWebh4OIqppWH5t5BW:yd50Ku8bNOSqpgH5/BW
Behavioral task
behavioral1
Sample
16888128718a66611c1d86e12.exe
Resource
win7-20230703-en
Malware Config
Extracted
quasar
1.3.0.0
Office04
qrss.duckdns.org:54790
QSR_MUTEX_zlSKJvcuVjgb1gOk4J
-
encryption_key
vUOWxZSgsTmyyUM9Rgsw
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
16888128718a66611c1d86e12.datdecoded
-
Size
348KB
-
MD5
7834a7e88c159e7f55934c740ca39935
-
SHA1
c5a4dcd4454df284e95472a972511c2488bd79ac
-
SHA256
b8eda4e9e691fe7017981cea833b63299ea6b89e08f3995b630cf705a393d16b
-
SHA512
2c3f4f70cb898eb6fafa60b8f55301ef4b3c1918c527bec6f8721c5146c4affef28bdabda991fdb799df78dc74d70af7d57989fb00dcb787e23a42ee851b4b7d
-
SSDEEP
6144:r2NHXf500MRWfu7waMmbUIgiWebh4OIqppWH5t5BW:yd50Ku8bNOSqpgH5/BW
-
Quasar payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-