Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
loli.exe
-
Size
3.1MB
-
Sample
240915-ln1vyaxgml
-
MD5
fc04e19e18532ba031bd6e05fad571b1
-
SHA1
d124d44ac3afc724c4cfa84af182af347b430cfa
-
SHA256
677b56921e0ac313d88a476865bcdfbc59ae7b941a4f31ee98cff34b5b47c67a
-
SHA512
f0c11c3c79dbfaae2a7cd18335dfc2b55477b7b5cc7750f31f7817cbb71f405bb8a7a6b09d246e29e2b21f5568467241fb9fc7661ed207a914c0ed77c887e9dc
-
SSDEEP
49152:XvkG42pda6D+/PjlLOlg6yQipVlZyg+vEPTHHB72eh2NT:XvP42pda6D+/PjlLOlZyQipVlZR
Behavioral task
behavioral1
Sample
loli.exe
Resource
win7-20240903-en
Malware Config
Extracted
quasar
1.4.1
Slave
manufacturer-iran.gl.at.ply.gg:46957
manufacturer-iran.gl.at.ply.gg:5047
261b229e-a9e0-46eb-b59b-76313ea213fe
-
encryption_key
F7ACA224CAA318E1652BB3825C87CAD85F986692
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
SubDir
Targets
-
-
Target
loli.exe
-
Size
3.1MB
-
MD5
fc04e19e18532ba031bd6e05fad571b1
-
SHA1
d124d44ac3afc724c4cfa84af182af347b430cfa
-
SHA256
677b56921e0ac313d88a476865bcdfbc59ae7b941a4f31ee98cff34b5b47c67a
-
SHA512
f0c11c3c79dbfaae2a7cd18335dfc2b55477b7b5cc7750f31f7817cbb71f405bb8a7a6b09d246e29e2b21f5568467241fb9fc7661ed207a914c0ed77c887e9dc
-
SSDEEP
49152:XvkG42pda6D+/PjlLOlg6yQipVlZyg+vEPTHHB72eh2NT:XvP42pda6D+/PjlLOlZyQipVlZR
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-