Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

ripplewoofer.exe

windows7-x64

10

ripplewoofer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ripplewoofer.exe

  • Size

    3.1MB

  • MD5

    aefac3053fe23e06c3cd4c123a69ca37

  • SHA1

    3971e70e42e0148deb5b879da32bdcf6e3702197

  • SHA256

    af6a17197ef3da87971496daf39475598053e250d58c82c610d55ce4267102e2

  • SHA512

    2d611803fabd368214d61ef345eea20e41090a4db196e300782fb06d6fada2c548f909e3362a7c40852b3aab239b60e1acd613e523508be18f5e370375f40242

  • SSDEEP

    49152:GvUt62XlaSFNWPjljiFa2RoUYItaRJ61bR3LoGdf4pTHHB72eh2NT:GvI62XlaSFNWPjljiFXRoUYItaRJ6HP

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.28:4782

Mutex

21dc5e45-8c42-4e7e-a882-b318788e9ca8

Attributes
  • encryption_key

    C77A16FAC6C225B2DB880A8156F0D384EB290A9E

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Boostrapper

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ripplewoofer.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.