General
-
Target
https://www.shorturl.at/CRDfY
-
Sample
250107-v1ktxsspdl
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
NMW
C2
nm111-20223.portmap.host:20223
Mutex
0cf74134-5c38-42d6-bb49-4c83c1e37344
Attributes
-
encryption_key
F7F619EE7207F0CE79B19EAEA54D81315C5AE97B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Exm Tweaks
-
subdirectory
SubDir
Targets
-
-
Target
https://www.shorturl.at/CRDfY
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-