General
-
Target
https://gofile.io/d/KNKNlk
-
Sample
241209-esed6szjdz
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
EmmasSub
C2
rath3r.xyz:4782
Mutex
7126373e-e872-4f94-bbbb-42e88d57137b
Attributes
-
encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
-
install_name
Windows.WARP.JITService.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MicrosoftUpdateTaskMachineCore
-
subdirectory
ice
Targets
-
-
Target
https://gofile.io/d/KNKNlk
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-