Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
gaypornmail.exe
-
Size
3.1MB
-
Sample
240625-3ytm2stgrr
-
MD5
9cbc1d8a99e87feeb6077f26cb061429
-
SHA1
f0e3d7d0b2e5defc4aa4f24cd07396b3ddf88431
-
SHA256
4bca1aade0f88c32cb4e953c2cad495dae2e8f82d7096deea0b8f4370ff89ef8
-
SHA512
10408dd2375d529f92c72ea05a1cb736b85604f755f74cde4a7e7eba1ac35a42e4d29eed092161cc620aa2d592aee65d2926839bfc3f6ed6d397509749525a87
-
SSDEEP
49152:uv8t62XlaSFNWPjljiFa2RoUYIkCg1JNLoGd+THHB72eh2NT:uvA62XlaSFNWPjljiFXRoUYIkCG
Malware Config
Extracted
quasar
1.4.1
Office04
history-foo.gl.at.ply.gg:42349
2beddbf7-c691-4058-94c7-f54389b4a581
-
encryption_key
CBFC5D217E55BEBDCD3A6EFA924299F76BC328D9
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
SubDir
Targets
-
-
Target
gaypornmail.exe
-
Size
3.1MB
-
MD5
9cbc1d8a99e87feeb6077f26cb061429
-
SHA1
f0e3d7d0b2e5defc4aa4f24cd07396b3ddf88431
-
SHA256
4bca1aade0f88c32cb4e953c2cad495dae2e8f82d7096deea0b8f4370ff89ef8
-
SHA512
10408dd2375d529f92c72ea05a1cb736b85604f755f74cde4a7e7eba1ac35a42e4d29eed092161cc620aa2d592aee65d2926839bfc3f6ed6d397509749525a87
-
SSDEEP
49152:uv8t62XlaSFNWPjljiFa2RoUYIkCg1JNLoGd+THHB72eh2NT:uvA62XlaSFNWPjljiFXRoUYIkCG
-
Quasar payload
-