General
-
Target
https://buzzheavier.com/rysp7yi980jm
-
Sample
241128-bb98qsykax
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
SGVP
C2
192.168.1.9:4782
150.129.206.176:4782
Ai-Sgvp-33452.portmap.host:33452
Mutex
a35ec7b7-5a95-4207-8f25-7af0a7847fa5
Attributes
-
encryption_key
09BBDA8FF0524296F02F8F81158F33C0AA74D487
-
install_name
User Application Data.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windowns Client Startup
-
subdirectory
Quasar
Extracted
Family
asyncrat
Botnet
Default
C2
technical-southwest.gl.at.ply.gg:58694
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Targets
-
-
Target
https://buzzheavier.com/rysp7yi980jm
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Legitimate hosting services abused for malware hosting/C2
-