Overview

overview

10

Static

static

1

hellotesting1.bat

windows7-x64

3

hellotesting1.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hellotesting1.bat

  • Size

    710KB

  • Sample

    240530-mbjlkaea5t

  • MD5

    1c6a9ae804188b09a9d22a6ce2a4e16a

  • SHA1

    fd6cb4acd356a4b21fdd3d8bad229153fefe6803

  • SHA256

    2868c25ebff7a0b0ac9989e6df5a1d6f8625713980b1bf74af596d2204ed0d8c

  • SHA512

    2fd8a3f0398d8b81d03529d74c532239e9da40a8565ab1e48d3278eca2b880def39d96d8e364f6bfa98b4326ac7ac9636fd0666c4ac051e74d47a40b17d9c576

  • SSDEEP

    12288:0CA9ic1CGZWdhoXOExoF4LD4q+shjUIMgE4GScdQzNpxMtGh7CYS7lXInOZ1CTYz:0zTbkcxoi34qj5SgbGVG/xoK7CR3CTC

Score
10/10
quasarseroxen | v3.1.5 |executionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen | v3.1.5 |

C2

rights-varying.gl.at.ply.gg:55443

rights-varying.gl.at.ply.gg:3348
Mutex

$Sxr-jy6vh8CtEJL5ceZuIb

Attributes
  • encryption_key

    MIQZkzdNR10rFBFJyNsU

  • install_name

    $sxr-powershell.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    10

  • startup_key

    Powershell

  • subdirectory

    $sxr-seroxen2

Targets

    • Target

      hellotesting1.bat

    • Size

      710KB

    • MD5

      1c6a9ae804188b09a9d22a6ce2a4e16a

    • SHA1

      fd6cb4acd356a4b21fdd3d8bad229153fefe6803

    • SHA256

      2868c25ebff7a0b0ac9989e6df5a1d6f8625713980b1bf74af596d2204ed0d8c

    • SHA512

      2fd8a3f0398d8b81d03529d74c532239e9da40a8565ab1e48d3278eca2b880def39d96d8e364f6bfa98b4326ac7ac9636fd0666c4ac051e74d47a40b17d9c576

    • SSDEEP

      12288:0CA9ic1CGZWdhoXOExoF4LD4q+shjUIMgE4GScdQzNpxMtGh7CYS7lXInOZ1CTYz:0zTbkcxoi34qj5SgbGVG/xoK7CR3CTC

    Score
    10/10
    executionquasarseroxen | v3.1.5 |spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks