Overview

overview

10

Static

static

10

waasdfasdf...ed.exe

windows7-x64

10

waasdfasdf...ed.exe

windows10-2004-x64

10

Resubmissions

05-02-2025 01:47

250205-b72apsvmaj 10

05-02-2025 01:46

250205-b689xstjct 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    waasdfasdfa-cleaned.exe

  • Size

    9.6MB

  • Sample

    250205-b689xstjct

  • MD5

    f7dff4ea8253c72ac87edc0fb5bad744

  • SHA1

    0ad62cbeb4bbfe55f598d8150eb47fe11c605d18

  • SHA256

    1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2

  • SHA512

    01aac77f314af5650a9c9e2c4dc6033e57c83eed73b1245ff807c8740cb5e4ecd247b82c0289d8d2371a3c4eaebfcfbcf20a97ee1305562caebb4e0fc1ab5701

  • SSDEEP

    98304:pCjJmhnQCCHMFfrblOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO0y:fVgMFfrbli5lSmZ4b0az+RiZi

Score
10/10
quasarseroxenv15.0 | fifa23spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

C2

private123.duckdns.org:8808

dofucks.com:8808
Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes
  • encryption_key

    C84CB6134701741C5122A14FACDB67C8CFA9C0AB

  • install_name

    .exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    $sxr-seroxen

Targets

    • Target

      waasdfasdfa-cleaned.exe

    • Size

      9.6MB

    • MD5

      f7dff4ea8253c72ac87edc0fb5bad744

    • SHA1

      0ad62cbeb4bbfe55f598d8150eb47fe11c605d18

    • SHA256

      1a94dce8eb86e5a531a316491267bfba4dae6bab0e5a89b84f6ddcf8e0dd57c2

    • SHA512

      01aac77f314af5650a9c9e2c4dc6033e57c83eed73b1245ff807c8740cb5e4ecd247b82c0289d8d2371a3c4eaebfcfbcf20a97ee1305562caebb4e0fc1ab5701

    • SSDEEP

      98304:pCjJmhnQCCHMFfrblOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO0y:fVgMFfrbli5lSmZ4b0az+RiZi

    Score
    10/10
    quasarseroxenv15.0 | fifa23spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Seroxen family

      seroxen

    • Seroxen, Ser0xen

      Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

      trojanseroxen

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks