Overview

overview

10

Static

static

3

extracted_payload.exe

windows10-2004-x64

10

extracted_payload.exe

windows10-ltsc 2021-x64

10

extracted_payload.exe

windows11-21h2-x64

10

Resubmissions

05-02-2025 00:08

250205-afas1a1khq 10

05-02-2025 00:03

250205-acac3ayqet 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    extracted_payload.exe

  • Size

    5.8MB

  • Sample

    250205-acac3ayqet

  • MD5

    410e19496641d191d18eec16c6addd87

  • SHA1

    e007c3b22e3aade86364cc8e960062194c0c2883

  • SHA256

    6f8f3587f197afafce54790a5f61cc59790352f48e9ed2b7b282414f92be321c

  • SHA512

    32e8b7216df74fb36cbbb0bcb6bd6c7b89e82b725a4c777e5bd62e2084e67c66324acfc3ee0638814625ef2b87500680385a136e2f676581ba30d678063879ff

  • SSDEEP

    98304:qVzA+NolR3oceUQ1spbvuKSUJ17LrbH4q8y1iYVk1OUkh54oZdxkOHYSM:6PNO3K1spbmxcrbH4a1iYVk1O15DUC

Score
10/10
quasarseroxenv15.0 | fifa23spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

C2

private123.duckdns.org:8808

dofucks.com:8808
Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes
  • encryption_key

    C84CB6134701741C5122A14FACDB67C8CFA9C0AB

  • install_name

    .exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    $sxr-seroxen

Targets

    • Target

      extracted_payload.exe

    • Size

      5.8MB

    • MD5

      410e19496641d191d18eec16c6addd87

    • SHA1

      e007c3b22e3aade86364cc8e960062194c0c2883

    • SHA256

      6f8f3587f197afafce54790a5f61cc59790352f48e9ed2b7b282414f92be321c

    • SHA512

      32e8b7216df74fb36cbbb0bcb6bd6c7b89e82b725a4c777e5bd62e2084e67c66324acfc3ee0638814625ef2b87500680385a136e2f676581ba30d678063879ff

    • SSDEEP

      98304:qVzA+NolR3oceUQ1spbvuKSUJ17LrbH4q8y1iYVk1OUkh54oZdxkOHYSM:6PNO3K1spbmxcrbH4a1iYVk1O15DUC

    Score
    10/10
    quasarseroxenv15.0 | fifa23spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Seroxen family

      seroxen

    • Seroxen, Ser0xen

      Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

      trojanseroxen

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Tasks