Overview

overview

10

Static

static

1

Uni.bat

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Uni.bat

  • Size

    512KB

  • Sample

    240511-nwv1rsee9z

  • MD5

    d188d8d8e859b13330551005efc1f6cb

  • SHA1

    6e3e2c19174c7cd0e9a2c248c700cd25a7ee17da

  • SHA256

    7de9346c81bcb5b91230450e2092f27851f5cffb1837058e611ac103974f680a

  • SHA512

    1847acf391c3d7a21962ae19908af637f239edaab741d2c7dc9e876b04dea6f54b7d9d42ebf3634fff9283692b7ecb566e067368a77e618bb8b5ef402e33e59f

  • SSDEEP

    12288:i7ET3QCkmortzhYOPdMa0cqLepCUBD5LSWjU2d:GY3QCk7hXdMaELkVjU2d

Score
10/10
quasarseroxenexecutionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

C2

tue-jake.gl.at.ply.gg:29058

Mutex

$Sxr-xPAuDxLNyBmZ7S2WLJ

Attributes
  • encryption_key

    Pw78RUs175dFrKD7lMwH

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    SeroXen

  • subdirectory

    SubDir

Targets

    • Target

      Uni.bat

    • Size

      512KB

    • MD5

      d188d8d8e859b13330551005efc1f6cb

    • SHA1

      6e3e2c19174c7cd0e9a2c248c700cd25a7ee17da

    • SHA256

      7de9346c81bcb5b91230450e2092f27851f5cffb1837058e611ac103974f680a

    • SHA512

      1847acf391c3d7a21962ae19908af637f239edaab741d2c7dc9e876b04dea6f54b7d9d42ebf3634fff9283692b7ecb566e067368a77e618bb8b5ef402e33e59f

    • SSDEEP

      12288:i7ET3QCkmortzhYOPdMa0cqLepCUBD5LSWjU2d:GY3QCk7hXdMaELkVjU2d

    Score
    10/10
    quasarseroxenexecutionspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks