Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Client-built1111.exe
-
Size
3.1MB
-
Sample
250129-leldwssjfm
-
MD5
0adc6241197fc1fdcd36bd0f76f89b24
-
SHA1
e5eedce758351fe52c4bc3b230a319400dba6d8e
-
SHA256
b9474630c33784f2756c64ba626e2c9ed67c6a3498a28c5977950fd7bc5a041a
-
SHA512
c967faaef0efac7f6df8ca9abd6b9f661166b2a28bb271f39036f20f8dff7cfda361df9e080994535de6c05658c3d78c947b8e5ede7846316d73f5c3a02b06e3
-
SSDEEP
49152:jvClL26AaNeWgPhlmVqvMQ7XSKRsrhZmzVVoGdXNTHHB72eh2NT:jv6L26AaNeWgPhlmVqkQ7XSKGrhC
Behavioral task
behavioral1
Sample
Client-built1111.exe
Resource
win10ltsc2021-20250128-en
Malware Config
Extracted
quasar
1.4.1
oki
sohit13140-34151.portmap.host:30470
cec5225d-9f42-4988-9860-2cb3a2fa4d24
-
encryption_key
7762A5ABDBC4550BFD7A396634A33ED6BBC88F49
-
install_name
name.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Client-built1111.exe
-
Size
3.1MB
-
MD5
0adc6241197fc1fdcd36bd0f76f89b24
-
SHA1
e5eedce758351fe52c4bc3b230a319400dba6d8e
-
SHA256
b9474630c33784f2756c64ba626e2c9ed67c6a3498a28c5977950fd7bc5a041a
-
SHA512
c967faaef0efac7f6df8ca9abd6b9f661166b2a28bb271f39036f20f8dff7cfda361df9e080994535de6c05658c3d78c947b8e5ede7846316d73f5c3a02b06e3
-
SSDEEP
49152:jvClL26AaNeWgPhlmVqvMQ7XSKRsrhZmzVVoGdXNTHHB72eh2NT:jv6L26AaNeWgPhlmVqkQ7XSKGrhC
-
Quasar family
-
Quasar payload
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1