General
-
Target
https://limewire.com/d/2c5cda15-5516-4748-ac62-b6ef116b8fcf#yrvTrfrGn_W7iGo-QB1GU6izhnOoOaaJKH9z4ZdlpLY
-
Sample
250201-mzhzyayncx
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://limewire.com/d/2c5cda15-5516-4748-ac62-b6ef116b8fcf#yrvTrfrGn_W7iGo-QB1GU6izhnOoOaaJKH9z4ZdlpLY
Resource
win11-20241007-en
windows11-21h2-x64
20 signatures
900 seconds
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
FreeHotMamitas
C2
rigoc45241-20031.portmap.host:20031
Mutex
a72ea67c-61b4-4e94-b33c-c50db43d197d
Attributes
-
encryption_key
1ED3BAA2A271A5A1803405EC7EA135BF36E3B7A3
-
install_name
ReAgentC x86.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
.winsys
Targets
-
-
Target
https://limewire.com/d/2c5cda15-5516-4748-ac62-b6ef116b8fcf#yrvTrfrGn_W7iGo-QB1GU6izhnOoOaaJKH9z4ZdlpLY
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Drops file in System32 directory
-