General
- Target https://gofile.io/d/CdYiZB
- Sample260802-wgrc2ade96
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
xeNO
C2
-
192.168.1.59:4782
Mutex
-
807e7f8b-c361-461e-a83c-c838c194b939
Attributes
-
encryption_key
57DF511C91337D19DD39BBD98DEFC31CFD805360
-
install_name
Xeno.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Xeno_Logs
-
reconnect_delay
3000
-
startup_key
Xeno
-
subdirectory
SubDir
Targets
-
- Target https://gofile.io/d/CdYiZB
Score10/10-
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.