Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

PingOptimizerMain.bat

windows7-x64

1

PingOptimizerMain.bat

windows10-2004-x64

10

Resubmissions

09/01/2024, 11:27

240109-nkymhsgdcj 10

09/01/2024, 11:03

240109-m5m6vaffdq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PingOptimizerMain.bat

  • Size

    11.7MB

  • Sample

    240109-m5m6vaffdq

  • MD5

    ffc97bdf56ecbee34e263c88f330a9fd

  • SHA1

    7f83beb8534cdc3f3ee2147e74d6f698812f2859

  • SHA256

    d63b1658179ccc4b45c7f9726b83e32763850a046480b76a8f8920c709309b3e

  • SHA512

    09a9dbf6d13297a89ea4d1dbe56ae8f4485ecb832b8fe4cf302d805aa1077ed496e1e84024014ad2238b937fd09c21067112bf52aec373deaf4c20df51ae85c1

  • SSDEEP

    49152:zA8wtTTWxiw/n2WZfp8Nuw3PdwARNLfKu5LTEgwJt/eYr8ZLYY3GU80pJzgN5Vsi:X

Score
10/10
asyncratquasarv3.0.6 | seroxenratspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v3.0.6 | SeroXen

C2

amazon-nr.gl.at.ply.gg:56754

Mutex

a84ac298-1532-4b9d-a759-74f70b16a4b6

Attributes
  • encryption_key

    F28222E368B70A89947BE773CD2BA6F55AF0A35F

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

Targets

    • Target

      PingOptimizerMain.bat

    • Size

      11.7MB

    • MD5

      ffc97bdf56ecbee34e263c88f330a9fd

    • SHA1

      7f83beb8534cdc3f3ee2147e74d6f698812f2859

    • SHA256

      d63b1658179ccc4b45c7f9726b83e32763850a046480b76a8f8920c709309b3e

    • SHA512

      09a9dbf6d13297a89ea4d1dbe56ae8f4485ecb832b8fe4cf302d805aa1077ed496e1e84024014ad2238b937fd09c21067112bf52aec373deaf4c20df51ae85c1

    • SSDEEP

      49152:zA8wtTTWxiw/n2WZfp8Nuw3PdwARNLfKu5LTEgwJt/eYr8ZLYY3GU80pJzgN5Vsi:X

    Score
    10/10
    asyncratquasarv3.0.6 | seroxenratspywaretrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks