Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

eclipse executor.zip

windows7-x64

10

eclipse executor.zip

windows10-2004-x64

1

eclipse ex...or.exe

windows7-x64

10

eclipse ex...or.exe

windows10-2004-x64

10

Resubmissions

26/01/2025, 17:48

250126-wdl9xayjfw 10

26/01/2025, 17:45

250126-wbvs9syjax 10

Analysis

  • max time kernel
    1s
  • max time network
    4s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2025, 17:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eclipse executor/eclipse executor.exe

  • Size

    3.1MB

  • MD5

    1512ffa41753d2f49de5b5296f5c174e

  • SHA1

    596412e03c09c60c822f6e0d12072e4cb861fa72

  • SHA256

    1df2e7dd996b5cfc2aea6b38548ef0375664ef618743bbcb623df319f9e48f3e

  • SHA512

    b07550d650a0960b0ffda941e0a71c4ce4630964cd74c58e2ae21225cceb1666c6d1de234a0f1802578f4a9afeca653cd1f295bd4d5a97d4afbd1ff0f5f582f5

  • SSDEEP

    49152:rv3I22SsaNYfdPBldt698dBcjHaFenk3xg2oGdaBTHHB72eh2NT:rv422SsaNYfdPBldt6+dBcjHasno

Score
10/10
quasarmadespywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

made

C2

2001:569:7e70:6a00:c8f3:749c:278f:2c17:4782

Mutex

9d96368e-1352-46e3-8281-8f5eaf945edb

Attributes
  • encryption_key

    AF603C3CFA231D1BD841E315C27377C7E4A49333

  • install_name

    client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eclipse executor\eclipse executor.exe
    "C:\Users\Admin\AppData\Local\Temp\eclipse executor\eclipse executor.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2484-0-0x000007FEF5F63000-0x000007FEF5F64000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-1-0x0000000000030000-0x0000000000354000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2484-2-0x000007FEF5F60000-0x000007FEF694C000-memory.dmp

    Filesize

    9.9MB

    Download