Extracted

• • Target

    payload_1_sxr.exe

  • Size

    10.3MB

  • MD5

    a0986241fcfed849a9d1dce2466840de

  • SHA1

    6e47f0378ab7c921b3c04d29aae5de1415d1aaf8

  • SHA256

    ac562299cd216585d58cab4c435c1578f3e451820a4c0feb2d902d0662645446

  • SHA512

    8e192128a7be9b6b0857a3eca1a479ed28eaae2943ae1803fdd4b523c57e106f089c6b04cfe318a757171a3e52a603d91d395f94adbf9d5d5f300b3d91311ca4

  • SSDEEP

    49152:sKxzaVKJayp/GrDlGcfk/5ZRuUtNUDrTRaDqeF5gLRyoKq6XBkim7fEM27cIgpvW:sKxzcK

  Score

  10^/10

  seroxendefense_evasiontrojanquasarv2.2.2 | nugetadiscoveryspyware

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Seroxen family

    seroxen

  • Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2