Overview

overview

10

Static

static

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...2).exe

windows7-x64

10

uni/Uni - ...2).exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

uni/Uni - ...py.exe

windows7-x64

10

uni/Uni - ...py.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    uni.zip

  • Size

    7.7MB

  • Sample

    240602-g5d1aadf2x

  • MD5

    e4a5e077c5d559253ddca69cbb6b4e93

  • SHA1

    1a884bfc30b7183b68edac945a1f36f6f77e8889

  • SHA256

    fcd5b843d50ec2f973aaa27e54b6bf045931cc3cb8d9bea4edaade352fe0f7d5

  • SHA512

    a5dd4addd65c3385117a2cc4322b31cfc70b9f1a87cee92f6c34ae89b4154500c0c44d4472c85d768b28edc80e4622f5bb6fb5802f183b627ac1daf38cb57856

  • SSDEEP

    196608:80Dq8D0Jq3Y9+7srGs7ChQPWc/loGZ/yA5anj:80Dq8D0Jq3Y9+7srGs7ChQPWc/loGZ/w

Score
10/10
quasarseroxenexecutionpersistencespywaretrojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

C2

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892
Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes
  • encryption_key

    Lme7VBS3l58VwLM69PNM

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    SeroXen

  • subdirectory

    SubDir

Targets

    • Target

      uni/Uni - Copy (10) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      uni/Uni - Copy (11) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral3behavioral4

    • Target

      uni/Uni - Copy (12) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojanexecution

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral5behavioral6

    • Target

      uni/Uni - Copy (13) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral7behavioral8

    • Target

      uni/Uni - Copy (14) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral10behavioral9

    • Target

      uni/Uni - Copy (15) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral11behavioral12

    • Target

      uni/Uni - Copy (16) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral13behavioral14

    • Target

      uni/Uni - Copy (17) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral15behavioral16

    • Target

      uni/Uni - Copy (18) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral17behavioral18

    • Target

      uni/Uni - Copy (19) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral19behavioral20

    • Target

      uni/Uni - Copy (2) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenpersistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral21behavioral22

    • Target

      uni/Uni - Copy (2).exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral23behavioral24

    • Target

      uni/Uni - Copy (20) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral25behavioral26

    • Target

      uni/Uni - Copy (21) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral27behavioral28

    • Target

      uni/Uni - Copy (22) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral29behavioral30

    • Target

      uni/Uni - Copy (23) - Copy.exe

    • Size

      409KB

    • MD5

      b70fdac25a99501e3cae11f1b775249e

    • SHA1

      3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

    • SHA256

      51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

    • SHA512

      43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

    • SSDEEP

      12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral31behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

16
T1053

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Scheduled Task/Job

16
T1053

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Scheduled Task/Job

16
T1053

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

11
T1112

Credential Access

Discovery

System Information Discovery

25
T1082

Query Registry

22
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

seroxenquasar
Score
10/10

behavioral1

quasarseroxenspywaretrojan
Score
10/10

behavioral2

quasarseroxenspywaretrojan
Score
10/10

behavioral3

quasarseroxenspywaretrojan
Score
10/10

behavioral4

quasarseroxenspywaretrojan
Score
10/10

behavioral5

quasarseroxenspywaretrojan
Score
10/10

behavioral6

quasarseroxenexecutionspywaretrojan
Score
10/10

behavioral7

quasarseroxenspywaretrojan
Score
10/10

behavioral8

quasarseroxenspywaretrojan
Score
10/10

behavioral9

quasarseroxenspywaretrojan
Score
10/10

behavioral10

quasarseroxenspywaretrojan
Score
10/10

behavioral11

quasarseroxenspywaretrojan
Score
10/10

behavioral12

quasarseroxenspywaretrojan
Score
10/10

behavioral13

quasarseroxenspywaretrojan
Score
10/10

behavioral14

quasarseroxenspywaretrojan
Score
10/10

behavioral15

quasarseroxenspywaretrojan
Score
10/10

behavioral16

quasarseroxenspywaretrojan
Score
10/10

behavioral17

quasarseroxenspywaretrojan
Score
10/10

behavioral18

quasarseroxenspywaretrojan
Score
10/10

behavioral19

quasarseroxenspywaretrojan
Score
10/10

behavioral20

quasarseroxenspywaretrojan
Score
10/10

behavioral21

quasarseroxenpersistencespywaretrojan
Score
10/10

behavioral22

quasarseroxenspywaretrojan
Score
10/10

behavioral23

quasarseroxenspywaretrojan
Score
10/10

behavioral24

quasarseroxenspywaretrojan
Score
10/10

behavioral25

quasarseroxenspywaretrojan
Score
10/10

behavioral26

quasarseroxenspywaretrojan
Score
10/10

behavioral27

quasarseroxenspywaretrojan
Score
10/10

behavioral28

quasarseroxenspywaretrojan
Score
10/10

behavioral29

quasarseroxenspywaretrojan
Score
10/10

behavioral30

quasarseroxenspywaretrojan
Score
10/10

behavioral31

quasarseroxenspywaretrojan
Score
10/10

behavioral32

quasarseroxenspywaretrojan
Score
10/10