General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
svhost32
C2
87.228.57.81:4782
Mutex
47b71fc0-b2c4-4112-b97a-39385a5399c1
Attributes
-
encryption_key
19A0FAF8459F69650B5965C225752D425C429EEC
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svhost32
-
subdirectory
SubDir
Targets
-
-
Target
https://github.com/menlichme/Roblox-Solara.git
-
Quasar family
-
Quasar payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-