Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Microsoft Gaming Helper.exe
-
Size
3.1MB
-
Sample
240214-te3beafh53
-
MD5
1f4df8c89189221420cd89ea0bdcf753
-
SHA1
30d7c89bd5d28870a5f6c25749ef2bb7b797de72
-
SHA256
b3573e1e395f30ce38648d8c9d5714ad35b0bcb93dbeabb1954e14b0199ca4d7
-
SHA512
4c7a66f7b5dff06328f6e737994e29dbec32931d9974c560d0867f67aef3a0c4f3a475f68d5299039bcde8528312611af18a654be34e6378a37d24e659be8ee1
-
SSDEEP
49152:3vbI22SsaNYfdPBldt698dBcjHwJRJ6/bR3LoGdJQ1THHB72eh2NT:3vk22SsaNYfdPBldt6+dBcjHwJRJ6RW
Behavioral task
behavioral1
Sample
Microsoft Gaming Helper.exe
Resource
win7-20231215-en
Malware Config
Extracted
quasar
1.4.1
Enayi
192.168.0.7:4782
cfb088c2-8243-4e30-af47-82a5b5bebf06
-
encryption_key
7AD862AAD94BE9C6EAA16CA4328915D7905AA3B4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Microsoft Gaming Helper.exe
-
Size
3.1MB
-
MD5
1f4df8c89189221420cd89ea0bdcf753
-
SHA1
30d7c89bd5d28870a5f6c25749ef2bb7b797de72
-
SHA256
b3573e1e395f30ce38648d8c9d5714ad35b0bcb93dbeabb1954e14b0199ca4d7
-
SHA512
4c7a66f7b5dff06328f6e737994e29dbec32931d9974c560d0867f67aef3a0c4f3a475f68d5299039bcde8528312611af18a654be34e6378a37d24e659be8ee1
-
SSDEEP
49152:3vbI22SsaNYfdPBldt698dBcjHwJRJ6/bR3LoGdJQ1THHB72eh2NT:3vk22SsaNYfdPBldt6+dBcjHwJRJ6RW
-
Quasar payload
-
Executes dropped EXE
-