General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
10.127.0.54:4782
Mutex
76898c6c-aad7-493e-ad05-6bb072bc1ab9
Attributes
-
encryption_key
E0AA33A7353AC58B6995079C718A83EE5609573D
-
install_name
Twrek.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Quasar payload
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory