Behavioral task
behavioral1
Sample
SeroXen.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SeroXen.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
SeroXen.exe
Resource
win10v2004-20240226-en
General
-
Target
SeroXen.exe
-
Size
38.6MB
-
MD5
89a7d73bad622bbd0b9dfb8e80f8c42e
-
SHA1
f1ac96f1d956254c6b2209f457355da89c987d8f
-
SHA256
7cb37cd110a388998ce95819da915446331f614a5da8d5cfeed953812ada23f1
-
SHA512
760e8e7087ac107ec9e12caaa26968142ddd62ddd82d0e6abfcaa35de8f03917323e97147e72b63fb3dca27756726f4f8fa68f89f9e5acc70898c4c4b0a7bdd0
-
SSDEEP
786432:anvEMOXrlkmTo5oJqpP2jXHUOqL4UoncLbd+fMY4RPHpHCpqBa4CE:anMMIrX05LsT0OqL4Uocd+fM/PlCpqcE
Malware Config
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar
Files
-
SeroXen.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50Certificate
IssuerCN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}Not Before29-07-2022 03:53Not After29-07-2023 09:53SubjectCN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}92:91:9c:08:de:7b:01:3c:33:6c:21:e5:08:45:c9:fd:94:9b:f3:6eSigner
Actual PE Digest92:91:9c:08:de:7b:01:3c:33:6c:21:e5:08:45:c9:fd:94:9b:f3:6eDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 38.5MB - Virtual size: 38.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ