General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
quasar
Version
1.3.0.0
Botnet
Office04
C2
127.0.0.1:4782
Mutex
QSR_MUTEX_n0f6at7YDD5llBKKrq
Attributes
-
encryption_key
Vj2Id1AoFxQx5HZ3Ncui
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Quasar payload
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.