Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    348KB

  • Sample

    241213-h3711ssjcs

  • MD5

    d4f5a1eaa8d1467c371ce8998e04a4e8

  • SHA1

    5ed12542244e20ae17dde30c3cac45aac000e863

  • SHA256

    4f75c8b2204dea15253538593f9543e9c08a6f32b6b62c3007a4be987768240b

  • SHA512

    703d6e78dbf440459a26011724af0e50a199c9a21eac050f2479d64655099c127b6813bb98c4149e0d48d95bbf431aa7b3eaacfd913328c3f5657f005c7b31b5

  • SSDEEP

    6144:LmqQ4i1FFiEKOfh82fqBvbbuz+PTL6S6oQ07O:Spli12Au0O3oQ07O

Score
10/10
quasartestdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Test

C2

4.tcp.eu.ngrok.io:8080

4.tcp.eu.ngrok.io:16210
Mutex

QSR_MUTEX_UChDVRqo1s5jujpKYt

Attributes
  • encryption_key

    lm1Hl2B1pRLn9MiBmo10

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      348KB

    • MD5

      d4f5a1eaa8d1467c371ce8998e04a4e8

    • SHA1

      5ed12542244e20ae17dde30c3cac45aac000e863

    • SHA256

      4f75c8b2204dea15253538593f9543e9c08a6f32b6b62c3007a4be987768240b

    • SHA512

      703d6e78dbf440459a26011724af0e50a199c9a21eac050f2479d64655099c127b6813bb98c4149e0d48d95bbf431aa7b3eaacfd913328c3f5657f005c7b31b5

    • SSDEEP

      6144:LmqQ4i1FFiEKOfh82fqBvbbuz+PTL6S6oQ07O:Spli12Au0O3oQ07O

    Score
    10/10
    quasartestdiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks