General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
quasar
Attributes
-
reconnect_delay
5000
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
10.127.1.117:4782
Mutex
bd747b07-4881-4e19-b67c-7424db4c9c00
Attributes
-
encryption_key
713CA4B737BEC5D3B6F68A1D4AC64155946D4161
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext