Overview

overview

10

Static

static

10

Uni.exe

windows10-1703-x64

10

Uni.exe

windows10-2004-x64

10

Uni.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Uni.exe

  • Size

    409KB

  • MD5

    a9ce2351f1e076f2a60e9ba4e3775e3e

  • SHA1

    6da0961ee36f14b8221c8f4944f22c528e7a9983

  • SHA256

    32f0e6d732c019b382e8375288c92211bf978aa0fd561174bb739f44467aba69

  • SHA512

    1db052a425a5e9df0907847c6eac8f019d3c0105b525615db2c5437f50cf549f5d49089321072037c6e83be5d79e5bdc9fa2860ed1c25b3bf0fa5f849bdf121d

  • SSDEEP

    6144:DMr2pJAJcC0B64Iwbrz4BAfb+QXfFqB5ouqbN2Bgq9RIxis/H2P8d8kpY:3pyJcC+zIwbrzl+QQQ2zI2Ud8eY

Score
10/10
seroxenquasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-ibPXck6MugFnUsQ7ci

Attributes
  • encryption_key

    0GQUKlnW9Vh0bWqKtciB

  • install_name

    $sxr-powershell.exe

  • log_directory

    $SXR-LOGS

  • reconnect_delay

    3000

  • startup_key

    $sxr-powershell

  • subdirectory

    $sxr-seroxen2

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Uni.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections