quasar | 6bf803ef550f4b654fe417656aa42d4a9bf467d96d99813deba7bd5bc6edb6f9

General

Target

waasdfasdfa-cleaned.exe
Size

9.6MB
Sample

250205-bw8weatrap
MD5

7a08b3d3a74cd47bdcb3de677069cc0e
SHA1

303280734566b299afa135056cce5576b5c48310
SHA256

6bf803ef550f4b654fe417656aa42d4a9bf467d96d99813deba7bd5bc6edb6f9
SHA512

19f1ebddaebe51c5cb71be9e1e0dd3edd403e973bd2ad171f96fa3ab08bc555896ab115e29d7ad794a6606cd18401e1b9ccf9eb2475b80b1ebc82ae1aae2008d
SSDEEP

98304:5+rEWXvUvUlSJSbWlOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO00:2/xSJSbWli5lSmZ4b0az+RiZi

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

v15.0 | Fifa23

C2

private123.duckdns.org:8808

dofucks.com:8808

Mutex

c398e98c-136e-4007-ab40-e179829f338c

Attributes

encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
install_name
.exe
log_directory
Logs
reconnect_delay
3000
startup_key
$sxr-seroxen

Targets

- Target
  
  waasdfasdfa-cleaned.exe
- Size
  
  9.6MB
- MD5
  
  7a08b3d3a74cd47bdcb3de677069cc0e
- SHA1
  
  303280734566b299afa135056cce5576b5c48310
- SHA256
  
  6bf803ef550f4b654fe417656aa42d4a9bf467d96d99813deba7bd5bc6edb6f9
- SHA512
  
  19f1ebddaebe51c5cb71be9e1e0dd3edd403e973bd2ad171f96fa3ab08bc555896ab115e29d7ad794a6606cd18401e1b9ccf9eb2475b80b1ebc82ae1aae2008d
- SSDEEP
  
  98304:5+rEWXvUvUlSJSbWlOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO00:2/xSJSbWli5lSmZ4b0az+RiZi
Score

10^/10

quasar seroxen v15.0 | fifa23 spyware trojan discovery
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Seroxen family
  seroxen
- Seroxen, Ser0xen
  Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.
  trojan seroxen
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar family

Quasar payload

Seroxen family

Seroxen, Ser0xen

Suspicious use of NtCreateUserProcessOtherParentProcess

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2