General
- Target https://gofile.io/d/ha5rjct1
- Sample260916-xk4cfavblc
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/ha5rjct1
Resource
win11-20260911-en
21 signatures
900 seconds
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
roblox executor scam
C2
-
149.106.242.200:4782
Mutex
-
a97b13a9-5457-48ba-ab73-5a8db8552df8
Attributes
-
encryption_key
835E2D2E27597D31B0430D9A101DBDD139D646C0
-
install_name
newera external v1.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
InfoSystem32 start up
-
subdirectory
InfoSystem32
Targets
-
- Target https://gofile.io/d/ha5rjct1
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.