quasar | SeroXen[.]exe | Triage

Sharing

General

Target

SeroXen.exe
Size

38.6MB
MD5

89a7d73bad622bbd0b9dfb8e80f8c42e
SHA1

f1ac96f1d956254c6b2209f457355da89c987d8f
SHA256

7cb37cd110a388998ce95819da915446331f614a5da8d5cfeed953812ada23f1
SHA512

760e8e7087ac107ec9e12caaa26968142ddd62ddd82d0e6abfcaa35de8f03917323e97147e72b63fb3dca27756726f4f8fa68f89f9e5acc70898c4c4b0a7bdd0
SSDEEP

786432:anvEMOXrlkmTo5oJqpP2jXHUOqL4UoncLbd+fMY4RPHpHCpqBa4CE:anMMIrX05LsT0OqL4Uocd+fM/PlCpqcE

Score

10^/10

quasar

Malware Config

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Files

SeroXen.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

25:cf:5c:85:5f:f8:f2:b3:42:ec:f2:23:23:8c:e8:50
Certificate

Issuer

CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}

Not Before

29-07-2022 03:53

Not After

29-07-2023 09:53

Subject

CN={C97DFA28-2A19-440B-8EB4-4EA8ABAEC4A4}

92:91:9c:08:de:7b:01:3c:33:6c:21:e5:08:45:c9:fd:94:9b:f3:6e
Signer

Actual PE Digest

92:91:9c:08:de:7b:01:3c:33:6c:21:e5:08:45:c9:fd:94:9b:f3:6e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 38.5MB - Virtual size: 38.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ