quasar | 6f8f3587f197afafce54790a5f61cc59790352f48e9ed2b7b282414f92be321c

General

Target

extracted_payload.exe
Size

5.8MB
Sample

250205-afas1a1khq
MD5

410e19496641d191d18eec16c6addd87
SHA1

e007c3b22e3aade86364cc8e960062194c0c2883
SHA256

6f8f3587f197afafce54790a5f61cc59790352f48e9ed2b7b282414f92be321c
SHA512

32e8b7216df74fb36cbbb0bcb6bd6c7b89e82b725a4c777e5bd62e2084e67c66324acfc3ee0638814625ef2b87500680385a136e2f676581ba30d678063879ff
SSDEEP

98304:qVzA+NolR3oceUQ1spbvuKSUJ17LrbH4q8y1iYVk1OUkh54oZdxkOHYSM:6PNO3K1spbmxcrbH4a1iYVk1O15DUC

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

C2

private123.duckdns.org:8808

dofucks.com:8808

Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes

encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
install_name
.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$sxr-seroxen

Targets

- Target
  
  extracted_payload.exe
- Size
  
  5.8MB
- MD5
  
  410e19496641d191d18eec16c6addd87
- SHA1
  
  e007c3b22e3aade86364cc8e960062194c0c2883
- SHA256
  
  6f8f3587f197afafce54790a5f61cc59790352f48e9ed2b7b282414f92be321c
- SHA512
  
  32e8b7216df74fb36cbbb0bcb6bd6c7b89e82b725a4c777e5bd62e2084e67c66324acfc3ee0638814625ef2b87500680385a136e2f676581ba30d678063879ff
- SSDEEP
  
  98304:qVzA+NolR3oceUQ1spbvuKSUJ17LrbH4q8y1iYVk1OUkh54oZdxkOHYSM:6PNO3K1spbmxcrbH4a1iYVk1O15DUC
Score

10^/10

quasar seroxen v15.0 | fifa23 discovery spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Seroxen family
  seroxen
- Seroxen, Ser0xen
  Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
  trojan seroxen
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar family

Quasar payload

Seroxen family

Seroxen, Ser0xen

Suspicious use of NtCreateUserProcessOtherParentProcess

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3