Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

445933fc1b...78.exe

windows7-x64

10

445933fc1b...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    445933fc1bdf9469526b8b84c5d6453d1db0d7fefe24bf50af987e1dabc60c78.exe

  • Size

    3.1MB

  • MD5

    6d548f65275db48621c739026edba1d6

  • SHA1

    7e8f3e64920984e407cfa5d257e67bfb885c67d8

  • SHA256

    445933fc1bdf9469526b8b84c5d6453d1db0d7fefe24bf50af987e1dabc60c78

  • SHA512

    c18b1593def2a6a1834016c61ba3be0bcd5e8dc37a5a889f1cbb924a252548ce3a5ac618a17c20112109015d509933a6a9c6823e437bf0e400f196de4f91266a

  • SSDEEP

    49152:rvOI22SsaNYfdPBldt698dBcjHxuRJ6PbR3LoGdsnTHHB72eh2NT:rvj22SsaNYfdPBldt6+dBcjHxuRJ6h

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

5.252.74.51:1337

Mutex

c9ab7a3b-f343-40bc-bf8b-f072c9beccf5

Attributes
  • encryption_key

    22D8B6518A5AB3703F6FD0075F58F8B4DB404298

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 445933fc1bdf9469526b8b84c5d6453d1db0d7fefe24bf50af987e1dabc60c78.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.