General
-
Target
https://gofile.io/d/ZkLIUG
-
Sample
240517-v3cakaae5v
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Windows Update
C2
skbidiooiilet-31205.portmap.host:31205
Mutex
7357b58d-e5d4-42be-8b74-db6eee6cde6d
Attributes
-
encryption_key
6F721445F7E0B1CF58980D84A9D49F4458D4EFD9
-
install_name
Update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsUpdate
-
subdirectory
Windows Update
Targets
-
-
Target
https://gofile.io/d/ZkLIUG
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-