General
-
Target
https://cdn.discordapp.com/attachments/1235717850421788722/1235947394470772736/SeroXen.rar?ex=676cb275&is=676b60f5&hm=196ee23fb797b7972d7eef79d4ae0c76cdaa82b260a8ed2629b51d024c404a49&
-
Sample
241225-gdkczszjgn
Score
10/10
Malware Config
Extracted
Family
quasar
Version
3.1.5
Botnet
serorox
C2
even-lemon.gl.at.ply.gg:33587
Mutex
$Sxr-g7zaoW2o45E5kvv6fX
Attributes
-
encryption_key
1mgSFiqbEggxxXXwqgX3
-
install_name
DLLrunHost.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
Discord
-
subdirectory
Windows
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1235717850421788722/1235947394470772736/SeroXen.rar?ex=676cb275&is=676b60f5&hm=196ee23fb797b7972d7eef79d4ae0c76cdaa82b260a8ed2629b51d024c404a49&
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-