Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/03/2025, 13:03

250314-qacneavkv5 10

General

  • Target

    VIRUSES.zip

  • Size

    67.2MB

  • MD5

    85282ad593314f89f12c427a8b6190d6

  • SHA1

    a4b3231c832a19318e489c2d4b95ee65ed9f7501

  • SHA256

    d9b33203556fafab59ac2a86ffc481da83dab9a29293639098cefd15fd686628

  • SHA512

    faa175c1a1f0c2301db17250f8ccc8122247cafcae4a0b9e606ce73c7f8292e549aadc19fe84545ffe7b4e8ca0006bd92c244cee2c9e2b1c3823caef9c32e769

  • SSDEEP

    1572864:RRju5peIneG9ahEuBzFrd8LxSeJ1xo5FON+K8a2:LEeInVMDpFx8LxSeDxo54EPa2

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

CleanerV2

C2

192.168.4.185:4782

Mutex

1607a026-352e-4041-bc1f-757dd6cd2e95

Attributes
  • encryption_key

    73BCD6A075C4505333DE1EDC77C7242196AF9552

  • install_name

    Client.exe

  • log_directory

    Clean

  • reconnect_delay

    3000

  • startup_key

    CleanerV2

  • subdirectory

    SubDir

Signatures

  • Detects Rhadamanthys payload 1 IoCs
  • Quasar family
  • Quasar payload 1 IoCs
  • Rhadamanthys family
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Unsigned PE 19 IoCs

    Checks for missing Authenticode signature.

Files

  • VIRUSES.zip
    .zip
  • CleanerV2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • InstallSetup.exe
    .exe windows:5 windows x86 arch:x86

    0af693e336b25366db7f002744db9d14


    Headers

    Imports

    Sections

  • Motrix-1.8.19-x64.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/app-64.7z
    .7z
  • LICENSE.electron.txt
  • LICENSES.chromium.html
  • Motrix.exe
    .exe windows:5 windows x64 arch:x64

    9f9c967fe6d2c8482cb4e000bbd84034


    Headers

    Imports

    Exports

    Sections

  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    dc71769f237c0a3ba38879380c54a4e6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    14338d2168d869b1b53d66354179e8c5


    Headers

    Imports

    Exports

    Sections

  • icudtl.dat
  • libEGL.dll
    .dll windows:5 windows x64 arch:x64

    592e6e55d4fe33d1bd84e3b3016fe3b2


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    b3384e5182b61c941805b07b7dc28efe


    Headers

    Imports

    Exports

    Sections

  • locales/af.pak
  • locales/am.pak
  • locales/ar.pak
  • locales/bg.pak
  • locales/bn.pak
  • locales/ca.pak
  • locales/cs.pak
  • locales/da.pak
  • locales/de.pak
  • locales/el.pak
  • locales/en-GB.pak
  • locales/en-US.pak
  • locales/es-419.pak
  • locales/es.pak
  • locales/et.pak
  • locales/fa.pak
  • locales/fi.pak
  • locales/fil.pak
  • locales/fr.pak
  • locales/gu.pak
  • locales/he.pak
  • locales/hi.pak
  • locales/hr.pak
  • locales/hu.pak
  • locales/id.pak
  • locales/it.pak
  • locales/ja.pak
  • locales/kn.pak
  • locales/ko.pak
  • locales/lt.pak
  • locales/lv.pak
  • locales/ml.pak
  • locales/mr.pak
  • locales/ms.pak
  • locales/nb.pak
  • locales/nl.pak
  • locales/pl.pak
  • locales/pt-BR.pak
  • locales/pt-PT.pak
  • locales/ro.pak
  • locales/ru.pak
  • locales/sk.pak
  • locales/sl.pak
  • locales/sr.pak
  • locales/sv.pak
  • locales/sw.pak
  • locales/ta.pak
  • locales/te.pak
  • locales/th.pak
  • locales/tr.pak
  • locales/uk.pak
  • locales/ur.pak
  • locales/vi.pak
  • locales/zh-CN.pak
  • locales/zh-TW.pak
  • resources.pak
  • resources/app-update.yml
  • resources/app.asar
  • resources/elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Headers

    Imports

    Sections

  • resources/engine/aria2.conf
  • resources/engine/aria2c.exe
    .exe windows:4 windows x64 arch:x64

    3f839183301e9c81aa621b5e6f8dd6f9


    Headers

    Imports

    Sections

  • snapshot_blob.bin
  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    c6d5499631d983c25f3393a4b4b13399


    Headers

    Imports

    Exports

    Sections

  • vk_swiftshader_icd.json
  • vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    49ed29c3ff417b26c7cd92ecc9b7dcb3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:6 windows x86 arch:x86

    2656ea25cde98f31a490513c2db04ae8


    Headers

    Imports

    Exports

    Sections

  • Rust_22_02_2023_gnp.exe
    .exe windows:5 windows x86 arch:x86

    12e12319f1029ec4f8fcbed7e82df162


    Headers

    Imports

    Sections

  • SoftCPU.exe
    .exe windows:5 windows x64 arch:x64

    b1c5b1beabd90d9fdabd1df0779ea832


    Headers

    Imports

    Sections

  • chrome.exe
    .exe windows:6 windows x86 arch:x86

    dbc825879296e020d5134f3622c3aca0


    Code Sign

    Headers

    Imports

    Sections

  • client.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • goodboy.exe
    .exe windows:10 windows x64 arch:x64

    89a4228e8581f783c2ab1992d9178f8e


    Headers

    Imports

    Sections

  • install.exe
    .exe windows:6 windows x86 arch:x86

    dbd248d6a07e5b5d3562c903534448e7


    Headers

    Imports

    Sections