Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
GGF41hifJmi6
-
delay
3
-
install
true
-
install_file
xd.exe
-
install_folder
%AppData%
Extracted
quasar
1.4.1
Office04
127.0.0.1:4782
abd61764-2256-41c2-ae70-7739d463e72c
-
encryption_key
224A079C40BF2588527AEA265249BF4F1DAE01C5
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp
-
Asyncrat family
-
Modifies visibility of file extensions in Explorer
-
Quasar family
-
Quasar payload
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
4