Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/01/2025, 12:20
General
-
Target
22ec96463885b4d35adc2f655171c3d985d48e69061542a2e87af651fe4cb5bc.exe
-
Size
3.1MB
-
MD5
a4ad38d230708b778ccfaed3e2f21d76
-
SHA1
5a1fc3eb971ab76dd10b42cd1d1ee512834ac1c2
-
SHA256
22ec96463885b4d35adc2f655171c3d985d48e69061542a2e87af651fe4cb5bc
-
SHA512
3661ae30a238917f1406cf969f0d6b36ef50e6ec0c14c761c5028da437ce907096075464d15128375d0337b36c70be9d8aa34ee1334539a9dd28b77167632393
-
SSDEEP
49152:SvMI22SsaNYfdPBldt698dBcjHwkxXvlYYoGdFTHHB72eh2NTw:Svh22SsaNYfdPBldt6+dBcjHwkxXvlDv
Malware Config
Extracted
quasar
1.4.1
NEWEST
154.216.20.177:3671
19fe5d5f-e5a0-498d-a3be-9e9a0724595d
-
encryption_key
2FD973A7D27B4716D866343EEDC06E9720A3448B
-
install_name
Client.exe
-
log_directory
wawa
-
reconnect_delay
300
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22ec96463885b4d35adc2f655171c3d985d48e69061542a2e87af651fe4cb5bc.exe"C:\Users\Admin\AppData\Local\Temp\22ec96463885b4d35adc2f655171c3d985d48e69061542a2e87af651fe4cb5bc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
10.8MB