General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
quasar
Version
1.3.0.0
Botnet
OWNED
C2
192.168.20.4:1604
Mutex
QSR_MUTEX_EObrfPyPOYO1BOZi4k
Attributes
-
encryption_key
rj4BgyoeMS4fUVDjZwh04ST7ogOJAQEF
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
auto_updater
-
subdirectory
SubDir
Targets
-
-
Quasar payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.