General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
quasar
Version
1.4.0.0
Botnet
Office04
C2
carolina-electro.at.ply.gg:23401:23401
Mutex
OkYd8B8aPhYGPmBnJV
Attributes
-
encryption_key
ifxqeoBwByp64Ea77ScW
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
windowsprogramm
-
subdirectory
SubDir
Targets
-
-
Target
https://anonfiles.com/zaQ7z0W0y8/Titanic_Executor_zip
-
Quasar payload
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-