General
- Target https://github.com/bloodstools/Ledger-Live-Larp
- Sample261025-bxy3laxyft
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/bloodstools/Ledger-Live-Larp
Resource
win10v2004-20260911-en
19 signatures
150 seconds
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Ledger Live
C2
-
86.131.107.165:4782
Mutex
-
c9be62e1-77a6-4fa6-b686-dbd6b1a14007
Attributes
-
encryption_key
BAEA628D8FB888D75DAD0A232F61413829D3D042
-
install_name
Ledger Live.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Ledger live
-
subdirectory
SubDir
Targets
-
- Target https://github.com/bloodstools/Ledger-Live-Larp
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.