General
- Target https://gofile.io/d/IaFCF2
- Sample260503-phvzaact2k
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Mods
C2
-
192.168.56.1:65535
Mutex
-
b4e92009-2262-49b3-9880-c82779bc759a
Attributes
-
encryption_key
4938D23D95E167BADB5F883A44549C522FAEA42F
-
install_name
Roblox .exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Mods_Keyboard
-
reconnect_delay
3000
-
startup_key
Roblox cheats
-
subdirectory
Mods
Targets
-
- Target https://gofile.io/d/IaFCF2
Score10/10-
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.