Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

92e33ea42c...2N.exe

windows7-x64

10

92e33ea42c...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92e33ea42ce90032fd696d413d2e137def473b2a39b3fa4f6070cc0615030892N.exe

  • Size

    3.1MB

  • MD5

    4b3436647f1997577f466e21705552c0

  • SHA1

    2f18780b0861be443a485972a90f8ea7b3b251a1

  • SHA256

    92e33ea42ce90032fd696d413d2e137def473b2a39b3fa4f6070cc0615030892

  • SHA512

    b72e3ab3f13b509731e5ee41160da2ac9539f9cdc58b329f145ec497e0f62b5e26e552e5e7b23dfe431f76f1d6d9de4cdbaf87ddea7dfdac934ce8701a360c4c

  • SSDEEP

    49152:7vPlL26AaNeWgPhlmVqvMQ7XSKhYYhBxVpoGdjTHHB72eh2NT:7vdL26AaNeWgPhlmVqkQ7XSKqYd

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.75:4782

Mutex

52ebf697-f063-428e-8231-fb3219c7b674

Attributes
  • encryption_key

    D4BE47CAF450CEF86308505E2B6631E7606F614F

  • install_name

    Bootstrapper.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WIndows Client Startup 64x

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 92e33ea42ce90032fd696d413d2e137def473b2a39b3fa4f6070cc0615030892N.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.