Extracted

• • Target

    payload_1.exe

  • Size

    10.3MB

  • MD5

    193c0f25237bf72feba33c0ac094633f

  • SHA1

    49d04b78ac3abed78f63f2a417aaaa3b2df015d0

  • SHA256

    f8431dd48bff13d43e84636a28c6f718f94c3fbaabfdc4505ba1c49390410dd0

  • SHA512

    f876fe18aa868e6b5fcca10e8def67f65be948283234c09cce5ab87938b1e797567498f6cc30ce7cd9bff3dd31a98a382bd950e1d49e1d782cce667516e62dd8

  • SSDEEP

    49152:AHZtA2qbxwSAKPbSZ8ncZSgiGrgXfaZAfCjCQquQplaoMc30D8zyYEF2SSmbUsr+:A54

  Score

  10^/10

  seroxentrojanquasarv2.2.5 | seroxendefense_evasiondiscoveryspyware

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Seroxen family

    seroxen

  • Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2