Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Client-built.exe
-
Size
3.1MB
-
Sample
250128-xn8fka1ngn
-
MD5
3436704fcaa032675bc4b8f1768f8ce2
-
SHA1
f7c0bcd46e674c467402fc0b9019b0e25e7ca547
-
SHA256
5f2520633846371a2777aeba2c39b8b22ba5f572d091dc9ad3aaa6a9da4c56c4
-
SHA512
4476ff2394193be61a2287cb8a3c20597a88b8028361c4b216b24a121a99939f9a5a3b0a2d77cf4f1fb3c6c9977de8e1f0b930e30f6abf6ccf75d3e3de71d366
-
SSDEEP
49152:DvXI22SsaNYfdPBldt698dBcjHou501vHLoDdftTHHB72eh2NT:DvY22SsaNYfdPBldt6+dBcjHou5K
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.0.24:4782
8778106a-0eb2-4d35-9617-d68276872dc3
-
encryption_key
6705C9378B815AFF21AE90A8CD796479C7CB6028
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Shell Experience
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
3436704fcaa032675bc4b8f1768f8ce2
-
SHA1
f7c0bcd46e674c467402fc0b9019b0e25e7ca547
-
SHA256
5f2520633846371a2777aeba2c39b8b22ba5f572d091dc9ad3aaa6a9da4c56c4
-
SHA512
4476ff2394193be61a2287cb8a3c20597a88b8028361c4b216b24a121a99939f9a5a3b0a2d77cf4f1fb3c6c9977de8e1f0b930e30f6abf6ccf75d3e3de71d366
-
SSDEEP
49152:DvXI22SsaNYfdPBldt698dBcjHou501vHLoDdftTHHB72eh2NT:DvY22SsaNYfdPBldt6+dBcjHou5K
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-