Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
-
submitted
23/03/2025, 16:24
General
-
Target
help.exe
-
Size
833KB
-
MD5
360c6e2eb3a061a3d9a549a5ff1dbf4e
-
SHA1
30dfac8784e9b232c3335dbaeea11f6c4eab9ca7
-
SHA256
abc501b89fdf6114096cff4068ccaaaa95bdbac4398f2d765ca8f7584b74b575
-
SHA512
8b467be39e1220676793bafaf53fa060be9d32f47d613f48d3972816255b541be9a40a9f54e9d0b9ff02dcde6484f9d2067b5ced6000cef70aa7dffef76c67cd
-
SSDEEP
24576:BaCudKStKHIPbcNK0KKfaOwI55l2S1JtL:BaCupKEgKKHwCB1
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.5.0
Botnet
Office04
C2
195.88.218.126:4782
Mutex
1e746a61-8f29-41da-ac54-b3913c261ad3
Attributes
-
encryption_key
CA4B6B826BE1A4CB863F0BA75BF75C12EC0DF1E5
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\help.exe"C:\Users\Admin\AppData\Local\Temp\help.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
856KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
312KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
240KB