Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

test.exe

windows7-x64

10

test.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.exe

  • Size

    1.4MB

  • Sample

    250228-fv9hrs1ygx

  • MD5

    b7b90c3d3f12be01a2508b40015cdae3

  • SHA1

    a14a3f57ae4f6d66da36636e41bb95efe4291999

  • SHA256

    fd5cb342981e9d61398e07e8ccbb12d758b0faec8515ed99c2fe070090b869e0

  • SHA512

    0ec46bbce7349bcae6b4068246b6c2a9feb6133697c4d192172878f5f8b5bfcdfbda7e8e06d4d211439e7a1251dd9a0e90d4b7d19ce76e00bb7b6356f16d467d

  • SSDEEP

    12288:qOBn5xPFMHnPHvw+XVTt6uQ4lPPwQ1Mg0xhOyoK5zKpyS1u5XHmIyg:qOfH8QmPwqMgwhfz6imxg

Score
10/10
quasarxwormoffice04ratspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

advertising-interfaces.gl.at.ply.gg:32479

Mutex

9e444bcd-22a0-41fd-b465-3a16b901895b

Attributes
  • encryption_key

    70773A6AB51CC4D9E9DBC452F577B4BEB037CC32

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    jdk-23_windows-x64

  • subdirectory

    SubDir

Extracted

Family

xworm

C2

operates-vampire.with.playit.plus:4353

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    XClient2.0.exe

Targets

    • Target

      test.exe

    • Size

      1.4MB

    • MD5

      b7b90c3d3f12be01a2508b40015cdae3

    • SHA1

      a14a3f57ae4f6d66da36636e41bb95efe4291999

    • SHA256

      fd5cb342981e9d61398e07e8ccbb12d758b0faec8515ed99c2fe070090b869e0

    • SHA512

      0ec46bbce7349bcae6b4068246b6c2a9feb6133697c4d192172878f5f8b5bfcdfbda7e8e06d4d211439e7a1251dd9a0e90d4b7d19ce76e00bb7b6356f16d467d

    • SSDEEP

      12288:qOBn5xPFMHnPHvw+XVTt6uQ4lPPwQ1Mg0xhOyoK5zKpyS1u5XHmIyg:qOfH8QmPwqMgwhfz6imxg

    Score
    10/10
    quasaroffice04spywaretrojanxwormrat

    • Detect Xworm Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks