Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe
-
Size
3.6MB
-
Sample
250129-khlndszrhq
-
MD5
678283be56a5f0178969a88915020601
-
SHA1
49932acde6ce46c7e2c982985deff7297667934a
-
SHA256
b35f831b82f4648f91b37d8b8799cb26d30b069a52cf12e14ba9b4c06e8fb571
-
SHA512
c8a51bde2f62d7230cd350b82942fd1de149843dd006e6de9dbc8149f0009b11c02d86313d4a676f3590f2e7af00e5eee6107b15f5af0378a1fc722435ec5df5
-
SSDEEP
98304:Ro+TeAkm0hMH+Xv590DRdEww+EwJVeZy2:RZ63pMH+Xv5GnEww+E2VeZf
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe
Resource
win7-20241010-en
Malware Config
Extracted
quasar
1.4.1
CODE
twart.myfirewall.org:9792
rency.ydns.eu:5287
wqo9.firewall-gateway.de:8841
code1.ydns.eu:5287
wqo9.firewall-gateway.de:9792
025351e291-5d1041-4fa37-932c7-869aeiQec514992
-
encryption_key
3145298725BA5E0DD56E87FFE3F8898EA81E6EDA
-
install_name
Exccelworkbook.exe
-
log_directory
Logs
-
reconnect_delay
6000
-
startup_key
pdfdocument
-
subdirectory
SubDir
Targets
-
-
Target
TRANSFERECIA - Banco Sabadell 20250128 € 9.750,00 Pago -www.bancsabadell.com.exe
-
Size
3.6MB
-
MD5
678283be56a5f0178969a88915020601
-
SHA1
49932acde6ce46c7e2c982985deff7297667934a
-
SHA256
b35f831b82f4648f91b37d8b8799cb26d30b069a52cf12e14ba9b4c06e8fb571
-
SHA512
c8a51bde2f62d7230cd350b82942fd1de149843dd006e6de9dbc8149f0009b11c02d86313d4a676f3590f2e7af00e5eee6107b15f5af0378a1fc722435ec5df5
-
SSDEEP
98304:Ro+TeAkm0hMH+Xv590DRdEww+EwJVeZy2:RZ63pMH+Xv5GnEww+E2VeZf
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-