Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

CACert/CACert.exe

windows7-x64

10

CACert/CACert.exe

windows10-2004-x64

10

CACert/Cre...on.exe

windows7-x64

10

CACert/Cre...on.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0afd97f96d8f8eae7f077296301e102a8e85a06daf09920c92e7b203c5e3236

  • Size

    2.1MB

  • MD5

    4539a5d184def6cb13472c306ecc9288

  • SHA1

    db4895027c9c37ce712f4c6f74aa1499034a25e0

  • SHA256

    a0afd97f96d8f8eae7f077296301e102a8e85a06daf09920c92e7b203c5e3236

  • SHA512

    59abd68e8ea3bde6607d0a5bf7a6a2c0d9860a20bc9c869cea158c75a8e86e2a8ed53599c48ee65b26fbc1d38dea84ab28ddbdf48c416b7311184cbccacf9c06

  • SSDEEP

    49152:B+V+zg3tk0spQsyXJEvYb9eO5Ragd+LMu8XRTU/casY:W3tSp4Jrl4qr16zsY

Score
10/10
noahquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Noah

C2

creditagricole.zapto.org:4444

Mutex

35b7f2fc-d3c2-4c55-949a-438b2c403cbf

Attributes
  • encryption_key

    482EAF21E4E65641294432E5F419F7A5A916811B

  • install_name

    CACert.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Credit Agricole Cert

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a0afd97f96d8f8eae7f077296301e102a8e85a06daf09920c92e7b203c5e3236
    .zip
  • CACert/CACert.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • CACert/Credit Agricole Certification.exe
    .exe windows:4 windows x86 arch:x86

    fa4d5c869351014d1ce952f2833a7558


    Code Sign

    Headers

    Imports

    Sections