Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

9d07e30f2a...36.exe

windows7-x64

10

9d07e30f2a...36.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d07e30f2a7238a495be924fa99761dd7e0dd300ec310e7d2d457ad7e6959b36.exe

  • Size

    3.1MB

  • MD5

    be32c281194c0a859cca202a418a16a3

  • SHA1

    e2c3885c8bc9b24b492f68a2c69ebf0c488abebc

  • SHA256

    9d07e30f2a7238a495be924fa99761dd7e0dd300ec310e7d2d457ad7e6959b36

  • SHA512

    541266a8f6b23b74d40c9d2656adb963c92ed5f8f2f239aa472649958f934f29a37afd42dfe27e9dfc2991c529dc949bffb6766223593c9ff7418778ad9bd36f

  • SSDEEP

    49152:HvnlL26AaNeWgPhlmVqvMQ7XSKKzDKkCWZLoGAVATHHB72eh2NT:HvlL26AaNeWgPhlmVqkQ7XSKKzDjp

Score
10/10
driver hostquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Driver Host

C2

VisoXC-59263.portmap.host:59263

Mutex

80b8889c-1e9f-4330-a95e-a3d9faf3bfc4

Attributes
  • encryption_key

    C1589EF424F77018CD488E8307C8C1DF199C8A42

  • install_name

    driverhost32.exe

  • log_directory

    Driver Logs

  • reconnect_delay

    3000

  • startup_key

    driverhost32

  • subdirectory

    Driver Host

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 9d07e30f2a7238a495be924fa99761dd7e0dd300ec310e7d2d457ad7e6959b36.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.