Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

5ab24c4a8d...95.exe

windows7-x64

10

5ab24c4a8d...95.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ab24c4a8d7dfdae95475a5252b0fc94561bbf18af68a84a81662050af2c6c95.exe

  • Size

    3.1MB

  • MD5

    3d5f1d38a92807e7de7d98838e05c7e8

  • SHA1

    38382972e6317a6e7010a8d48041e0960188fc48

  • SHA256

    5ab24c4a8d7dfdae95475a5252b0fc94561bbf18af68a84a81662050af2c6c95

  • SHA512

    35266e8c23536a0328e775ef879aac5683688994ada6eb9f91d4cdffdae71ff3a687bcb43deaf792c93b4735be2334b1fa6629a5f500645815cb32273dccaac0

  • SSDEEP

    49152:DvilL26AaNeWgPhlmVqvMQ7XSKnIRJ6ibR3LoGdWhNTHHB72eh2NTk:DvaL26AaNeWgPhlmVqkQ7XSKnIRJ6cY7

Score
10/10
triagequasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Triage

C2

sekacex395-58825.portmap.host:1194

Mutex

144ba9a1-0ea5-481a-929a-2aff73023537

Attributes
  • encryption_key

    480A149BDA5F1D4EEBD5CF8EA0711405B7FC59B1

  • install_name

    Client.exe

  • log_directory

    kLogs

  • reconnect_delay

    3000

  • startup_key

    Avast Free Antivirus

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5ab24c4a8d7dfdae95475a5252b0fc94561bbf18af68a84a81662050af2c6c95.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections