General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
192.168.87.77:4782
Mutex
-
d11f01e2-f047-4b1d-87d9-5ba9990ceadc
Attributes
-
encryption_key
8D80748F4532F141468BEDFB0B416C2797D791C9
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
- Target https://github.com/RuneOfficialSoftware/Celon-BootStrapper
Quasar payload
Downloads MZ/PE file
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2