Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
AstralAimbot_4.2.exe
-
Size
3.1MB
-
Sample
230827-gq8w4sfg79
-
MD5
d3b8122fe1ab8628492ba209d6da8c9d
-
SHA1
f19ba62ca57f4325e15a235dc0b74fa14b5624b2
-
SHA256
657fe3aede0f8a15771857f90cd59d8232b225d76b53bfe538a15089dea956a5
-
SHA512
ed3e762d7fbbddb265f96202db08dce57c7f03b4b73d537a0f497e410391d2e1d0eb0129a3a2a5e5c2c7352123ae765d8e891b9b5dce83eb1eaaaefc04af5b1a
-
SSDEEP
49152:Cvht62XlaSFNWPjljiFa2RoUYIQi/bdpqUoGdZizoTHHB72eh2NT:CvL62XlaSFNWPjljiFXRoUYIF/b8
Behavioral task
behavioral1
Sample
AstralAimbot_4.2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
AstralAimbot_4.2.exe
Resource
win10-20230703-en
Malware Config
Extracted
quasar
1.4.1
asdasd
6.tcp.ngrok.io:18160
a05bb804-7a29-47fc-917b-02ee2cb4b1a2
-
encryption_key
02C7E31FB83C81538B3B7AEA158F1FCCDC2B0FEA
-
install_name
asdsdasd.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SystEm32
-
subdirectory
dasdasd
Targets
-
-
Target
AstralAimbot_4.2.exe
-
Size
3.1MB
-
MD5
d3b8122fe1ab8628492ba209d6da8c9d
-
SHA1
f19ba62ca57f4325e15a235dc0b74fa14b5624b2
-
SHA256
657fe3aede0f8a15771857f90cd59d8232b225d76b53bfe538a15089dea956a5
-
SHA512
ed3e762d7fbbddb265f96202db08dce57c7f03b4b73d537a0f497e410391d2e1d0eb0129a3a2a5e5c2c7352123ae765d8e891b9b5dce83eb1eaaaefc04af5b1a
-
SSDEEP
49152:Cvht62XlaSFNWPjljiFa2RoUYIQi/bdpqUoGdZizoTHHB72eh2NT:CvL62XlaSFNWPjljiFXRoUYIF/b8
-
Quasar payload
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-