Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
240816-3q7vpsvckc
-
MD5
4c11f56b9a516468535cd9dfb4625554
-
SHA1
c85f8a363d0bc4071c82648736d04502a0f77b6e
-
SHA256
54f96306329acf69543eafbc220bb617151cf4f6572d05a1d99aa2633134b29f
-
SHA512
b525267b0de611e119c141962f9b8a2e054b3f5afa15140d098ca278e468658aac649c19b802076461fc283e7b7a826b146b3a2319e2af635df6eb820fd81e1d
-
SSDEEP
49152:tmCk6UTYfYnGJCvFt8lJ6QgeC2eH4THHB72eh2NT:tmsUTyYnGJCvFt8lJ6Qg5
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240704-en
Malware Config
Extracted
quasar
1.4.1
SKIDS
147.185.221.22:6712
4464eb7a-fcd4-46b0-a1b1-9f00f87d96f8
-
encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
-
install_name
Windows Host Process.exe
-
log_directory
WindowsLogs
-
reconnect_delay
3000
-
startup_key
Windows Host Process
-
subdirectory
Windows
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
4c11f56b9a516468535cd9dfb4625554
-
SHA1
c85f8a363d0bc4071c82648736d04502a0f77b6e
-
SHA256
54f96306329acf69543eafbc220bb617151cf4f6572d05a1d99aa2633134b29f
-
SHA512
b525267b0de611e119c141962f9b8a2e054b3f5afa15140d098ca278e468658aac649c19b802076461fc283e7b7a826b146b3a2319e2af635df6eb820fd81e1d
-
SSDEEP
49152:tmCk6UTYfYnGJCvFt8lJ6QgeC2eH4THHB72eh2NT:tmsUTyYnGJCvFt8lJ6Qg5
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-