Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2e9ba9334449304220a549e7a75447f4.bin
-
Size
1.0MB
-
Sample
231223-bpskvagcd8
-
MD5
a46fca9782afdf063d1e6e6690fa5747
-
SHA1
c5a152b8fab82f604dcbb02844bbe6025bd66dfa
-
SHA256
7737c5b0a53796e629145243f012aebb5cac709716d6c65d1608875ca1315dc3
-
SHA512
d4a36b61d4858b528d1e61d13f47702a32280dc400537619a886beed644ede2e9e8084e6e840fe0b0b64a158bb3913f3a40f6f903f69889c4ac603f477254857
-
SSDEEP
24576:YGQURqpkQbT7VB6EEHXWLHaEHyvr/pv1cKZycISuJXya:YHUeZB47aHqNZkXT
Behavioral task
behavioral1
Sample
f859bddda5d049e5449032b8a4373515a6a06cbc2019f9fc1c0c269ba4d90153.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f859bddda5d049e5449032b8a4373515a6a06cbc2019f9fc1c0c269ba4d90153.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Targets
-
-
Target
f859bddda5d049e5449032b8a4373515a6a06cbc2019f9fc1c0c269ba4d90153.exe
-
Size
2.0MB
-
MD5
2e9ba9334449304220a549e7a75447f4
-
SHA1
791d1648ee703e05b4749fcb99c8f45692e73787
-
SHA256
f859bddda5d049e5449032b8a4373515a6a06cbc2019f9fc1c0c269ba4d90153
-
SHA512
91f5e99e4e69ece69f1eb4a72b69bf77e42092ad2bb40d6f480768148a2490f3bf747b507b3a52446d60eb53373f7f3b64d16fe1993e58dd10ec0430cf91bcff
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKY1:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YL
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-