General
- Target https://release-assets.githubusercontent.com/github-production-release-asset/21611723/d75c6858-c13a-423b-8923-6bb449cac454?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-07T22%3A57%3A00Z&rscd=attachment%3B+filename%3DQuasar.v1.4.1.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-07T21%3A56%3A39Z&ske=2026-08-07T22%3A57%3A00Z&sks=b&skv=2018-11-09&sig=MPQmExj4xMOJ6zTDShxBV2HoEC5u0FgiQsY%2FBE4lXs4%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NjE0MDUyNCwibmJmIjoxNzg2MTQwMjI0LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.cv0yzLQwoySDHonL-JgCWqxsM-vobli0Mur7pUrh5po&response-content-disposition=attachment%3B%20filename%3DQuasar.v1.4.1.zip&response-content-type=application%2Foctet-stream
- Sample260807-1yykwsdk4v
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
10.127.0.5:4782
Mutex
-
5becc6ca-da8d-4e8c-9b3d-f11461198602
Attributes
-
encryption_key
9C6B4C3E326775F4131AF047AECB68CE0E6F08D9
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
- Target https://release-assets.githubusercontent.com/github-production-release-asset/21611723/d75c6858-c13a-423b-8923-6bb449cac454?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-07T22%3A57%3A00Z&rscd=attachment%3B+filename%3DQuasar.v1.4.1.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-07T21%3A56%3A39Z&ske=2026-08-07T22%3A57%3A00Z&sks=b&skv=2018-11-09&sig=MPQmExj4xMOJ6zTDShxBV2HoEC5u0FgiQsY%2FBE4lXs4%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NjE0MDUyNCwibmJmIjoxNzg2MTQwMjI0LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.cv0yzLQwoySDHonL-JgCWqxsM-vobli0Mur7pUrh5po&response-content-disposition=attachment%3B%20filename%3DQuasar.v1.4.1.zip&response-content-type=application%2Foctet-stream
Score10/10-
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Drops desktop.ini file(s)