Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

314e9bbe1e...a6.exe

windows7-x64

10

314e9bbe1e...a6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    314e9bbe1e43938595f774fe97f4926c9f169493f9ea6.exe

  • Size

    3.1MB

  • MD5

    03b55d6ac2f64414dc30dd72b0da1f0f

  • SHA1

    ef558eca01ec67ab75e9f95d8e8bf7a669bc8ae3

  • SHA256

    314e9bbe1e43938595f774fe97f4926c9f169493f9ea6f5a5f2b31d7f636cacd

  • SHA512

    0facab9d27811af1ff6327fdef4444eb93aba175979a0d4788ff3c8709bcb6f9600d6d9b5febc0ee6b079590d30cf72db91b14d513f7996bd37e62285ef7f426

  • SSDEEP

    49152:DvEI22SsaNYfdPBldt698dBcjH5OokzoaM7LoGTUTHHB72eh2NT:Dvp22SsaNYfdPBldt6+dBcjHAnzu

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

193.161.193.99:35024

Mutex

c43ec3d5-ee0a-428c-b759-6a528906b342

Attributes
  • encryption_key

    55EBDCAC6A0AD087E3335B935F8905200B2957F3

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    100

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 314e9bbe1e43938595f774fe97f4926c9f169493f9ea6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections