Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
FlashingSoftwarePRO.exe
Resource
win7-20240903-en
General
-
Target
FlashingSoftwarePRO.exe
-
Size
3.1MB
-
MD5
b2f5d1078f1ed4eb8547f19b48dc5126
-
SHA1
657254864bfab24f564888e230da7f46266ecb4c
-
SHA256
4f872140210a9253c0deb66a65f0c265a194e85d99a639f406d927a1ac760903
-
SHA512
9f850a289fd4ac3b7f1e94e8ec179b99e6ae9c78cd7ef164aefd87c4d14d9f7995c60596cc1720a17afe0fc40d32715886a9fd8695c11ac6941077e45528c882
-
SSDEEP
49152:vvxI22SsaNYfdPBldt698dBcjH1uRJ6ebR3LoGduTHHB72eh2NT:vvi22SsaNYfdPBldt6+dBcjH1uRJ6Y
Malware Config
Extracted
quasar
1.4.1
svchost
7.tcp.eu.ngrok.io:10771
7.tcp.eu.ngrok.io:4782
75e27cf2-023d-4d6d-9a0d-265f3da40a2e
-
encryption_key
BDB44181C868606DFCA1741A69056AAA62DADEFC
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
300
-
startup_key
RuntimeBroker
-
subdirectory
System32
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FlashingSoftwarePRO.exe
Files
-
FlashingSoftwarePRO.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ