General
- Target https://gofile.io/d/ulaPt8
- Sample240820-cype8azakc
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
68.42.195.247:4782
Mutex
-
ad0f7387-fe1b-4a82-9421-c44b18f7e4f5
Attributes
-
encryption_key
C3F94E1E0C38147BE2D5DEE51F63F205F19D8EB9
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows expl1orer
-
subdirectory
SubDir
Targets
-
- Target https://gofile.io/d/ulaPt8
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory