General
- Target https://gofile.io/d/u1fsAI
- Sample240820-len5saybql
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
loletScript-55049.portmap.host:55049
Mutex
-
83ccefa2-233e-4371-bd98-f84307d3d975
Attributes
-
encryption_key
237F842816ACAEB97B9536F65F6A1A362E20E605
-
install_name
systemhost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
- Target https://gofile.io/d/u1fsAI
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Mark of the Web detected: This indicates that the page was originally saved or cloned.
-
Drops file in System32 directory