General
-
Target
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbUFNMTZlU0pNamkydUZkVFBySWNoV2p4VWc5QXxBQ3Jtc0tuZnVWajl1TVUtdDhTTmJINVd2ZWdWb1dGUFcxUGViSHVsTGkzbnFNQ0IxMXJtT2tCQ2s2eXFHcklNZVBvVHh2bTBCcUNBMFhxVTFRZHhFQ3dLX2M4R0tOYV92Q3Fhc2N4d2FvVFMzOUFSaHFBZzI3aw&q=https%3A%2F%2Frkns.link%2Fxgiz1
-
Sample
250104-xqma4ssmht
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbUFNMTZlU0pNamkydUZkVFBySWNoV2p4VWc5QXxBQ3Jtc0tuZnVWajl1TVUtdDhTTmJINVd2ZWdWb1dGUFcxUGViSHVsTGkzbnFNQ0IxMXJtT2tCQ2s2eXFHcklNZVBvVHh2bTBCcUNBMFhxVTFRZHhFQ3dLX2M4R0tOYV92Q3Fhc2N4d2FvVFMzOUFSaHFBZzI3aw&q=https%3A%2F%2Frkns.link%2Fxgiz1
Resource
win10v2004-20241007-en
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.0.28:4782
21dc5e45-8c42-4e7e-a882-b318788e9ca8
-
encryption_key
C77A16FAC6C225B2DB880A8156F0D384EB290A9E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Boostrapper
-
subdirectory
SubDir
Targets
-
-
Target
https://www.youtube.com/redirect?event=comments&redir_token=QUFFLUhqbUFNMTZlU0pNamkydUZkVFBySWNoV2p4VWc5QXxBQ3Jtc0tuZnVWajl1TVUtdDhTTmJINVd2ZWdWb1dGUFcxUGViSHVsTGkzbnFNQ0IxMXJtT2tCQ2s2eXFHcklNZVBvVHh2bTBCcUNBMFhxVTFRZHhFQ3dLX2M4R0tOYV92Q3Fhc2N4d2FvVFMzOUFSaHFBZzI3aw&q=https%3A%2F%2Frkns.link%2Fxgiz1
-
Quasar family
-
Quasar payload
-
Downloads MZ/PE file
-
A potential corporate email address has been identified in the URL: httpswww.youtube.com@mray20081subconfirmation1cbrd1
-
Executes dropped EXE
-