Extracted

• • Target
    Uni.bat
  • Size 10.4MB
  • SHA256 d05dd87b7ce909f8f3f85607f9546bcbe1168a507955c4d504d8c83f02d9a909
  • MD5 2cc589a27044382be0ec55f23f36fa41
  • SHA1 4edc18c1b0e3558086e86d4e5c344fc9bed8d97c
  • SHA512 baf948e4257cda2a0c30e9663448e884d40d844cc0f15cb64a9a2ccc40c12d1bdf1b5808d80b19c0f401478504468669d44edcdf0153f88d1b3ceb3303656045
  • SSDEEP 49152:C/JouIj6nHI8l5lK7g/JLyDX7YVDazqMdubv+JrncVzgH+60gF4SLF+pHGwhESAG:K
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  v15.4.5 | seroxendefense_evasiondiscoveryquasarseroxenpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Seroxen family

    seroxen

  • Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2