Overview

overview

10

Static

static

1

Uni.bat

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Uni.bat
  • Size 12.6MB
  • Sample240527-afh5daaa86
  • SHA256 78b0a14a882dec287c0dc5a294ad02a4a5aaa0d130839d49f282c7d61069471f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasarv2.2.5 | seroxenspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.0.0.0

Botnet

  • v2.2.5 | SeroXen

C2

  • kimsoylak.ddns.net:4782

Mutex

  • 2cc9d61f-950d-4f23-b7d5-45d9dda2f256

Attributes
  • encryption_key

    F467D794B2E1081B6AD1EAD5813AFA74F053248D

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    1

Targets

    • Target
      Uni.bat
    • Size 12.6MB
    • SHA256 78b0a14a882dec287c0dc5a294ad02a4a5aaa0d130839d49f282c7d61069471f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasarv2.2.5 | seroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks