General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
-
quasar
Version
-
1.6.0
Botnet
-
shkila
C2
-
193.161.193.99:41352
-
popapopa-41352.portmap.host:41352
Mutex
-
e5e1152e-3672-429c-b7fc-3d93aeb58521
Attributes
-
encryption_key
9F7D33FC2DDC17156CE7BD9174438AEDACB8A664
-
install_name
Client.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Mlcrosoft OneDrive
-
subdirectory
subfir
Targets
-
- Target https://drive.google.com/file/d/1VB-S6GEyUf3qaq5XJreqY_d8PiJeHO5T/view?usp=sharing
Quasar family
Quasar payload
Executes dropped EXE
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.