General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
-
asyncrat
Version
-
0.5.8
Botnet
-
Default
C2
-
10.9.194.102:4782
Mutex
-
2zoUIbkbNDNs
Attributes
-
delay
3
-
install
true
-
install_file
SystemApplication.exe
-
install_folder
%AppData%
aes.plain
aes.plain
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
10.9.194.102:4782
Mutex
-
26d07bf2-5c04-4a61-9669-c4e1e3d08469
Attributes
-
encryption_key
2E7824B257446B649651FDC95DA115A0980049D0
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
- Target https://github.com/phxn-blip?tab=repositories
-
Async RAT payload
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1