Overview

overview

10

Static

static

3

SeronObf.exe

windows7-x64

10

SeronObf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SeronObf.exe

  • Size

    3.1MB

  • Sample

    241227-14r1as1naq

  • MD5

    44177e3bdbc790c06a268a02dced77c4

  • SHA1

    13578ac3ea2bb995f6f846a27ca82de1b3186db7

  • SHA256

    7f3c5bf53129adfeb789c38f8dabda4b997545ad6a92d85cd1cb43a47e4417b2

  • SHA512

    790e3ad20b45c6233453b9ca00e4939e6c6dcf966d276c66843ce5dbf60400cfb4df77933d77de97f2aab3d40c5a4c5a6fdc2af36ae2cac2af67789589021bc7

  • SSDEEP

    98304:kIDq/kB9hLn7+YOBqJaQbmOsAdcpLrQVv3N:TDvZLn7+YOsMQbBQrm

Score
10/10
quasarserondiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Seron

C2

nigeboc465-58875.portmap.host:58875

Mutex

eb8602ec-8a0d-4322-b9a0-544571be5a2d

Attributes
  • encryption_key

    8BD9150EEC3DA71ED82080D7AEB7C165A58C889F

  • install_name

    f8mk7ZGwVUpulm.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    f8mk7ZGwVUpulm

  • subdirectory

    SubDir

Targets

    • Target

      SeronObf.exe

    • Size

      3.1MB

    • MD5

      44177e3bdbc790c06a268a02dced77c4

    • SHA1

      13578ac3ea2bb995f6f846a27ca82de1b3186db7

    • SHA256

      7f3c5bf53129adfeb789c38f8dabda4b997545ad6a92d85cd1cb43a47e4417b2

    • SHA512

      790e3ad20b45c6233453b9ca00e4939e6c6dcf966d276c66843ce5dbf60400cfb4df77933d77de97f2aab3d40c5a4c5a6fdc2af36ae2cac2af67789589021bc7

    • SSDEEP

      98304:kIDq/kB9hLn7+YOBqJaQbmOsAdcpLrQVv3N:TDvZLn7+YOsMQbBQrm

    Score
    10/10
    quasarserondiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks