Overview

overview

10

Static

static

10

SeroXen.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SeroXen.exe

  • Size

    38.6MB

  • Sample

    241226-zq9shszmek

  • MD5

    89a7d73bad622bbd0b9dfb8e80f8c42e

  • SHA1

    f1ac96f1d956254c6b2209f457355da89c987d8f

  • SHA256

    7cb37cd110a388998ce95819da915446331f614a5da8d5cfeed953812ada23f1

  • SHA512

    760e8e7087ac107ec9e12caaa26968142ddd62ddd82d0e6abfcaa35de8f03917323e97147e72b63fb3dca27756726f4f8fa68f89f9e5acc70898c4c4b0a7bdd0

  • SSDEEP

    786432:anvEMOXrlkmTo5oJqpP2jXHUOqL4UoncLbd+fMY4RPHpHCpqBa4CE:anMMIrX05LsT0OqL4Uocd+fM/PlCpqcE

Score
10/10
quasarevasionspywarethemidatrojan

Malware Config

Targets

    • Target

      SeroXen.exe

    • Size

      38.6MB

    • MD5

      89a7d73bad622bbd0b9dfb8e80f8c42e

    • SHA1

      f1ac96f1d956254c6b2209f457355da89c987d8f

    • SHA256

      7cb37cd110a388998ce95819da915446331f614a5da8d5cfeed953812ada23f1

    • SHA512

      760e8e7087ac107ec9e12caaa26968142ddd62ddd82d0e6abfcaa35de8f03917323e97147e72b63fb3dca27756726f4f8fa68f89f9e5acc70898c4c4b0a7bdd0

    • SSDEEP

      786432:anvEMOXrlkmTo5oJqpP2jXHUOqL4UoncLbd+fMY4RPHpHCpqBa4CE:anMMIrX05LsT0OqL4Uocd+fM/PlCpqcE

    Score
    10/10
    quasarevasionspywarethemidatrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks