General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
quasar
Version
1.4.0.0
Botnet
Office
C2
espinyskibidi-40205.portmap.host:40205
Mutex
CdrjrrWbtRopP1ic7E
Attributes
-
encryption_key
P2ctPN6uGReD4W1dEypm
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Client
-
subdirectory
Microsoft
Targets
-
-
Target
https://github.com/cfedss/xMainDab/releases/download/101/xMainDab.rar
-
Quasar payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-