Overview

overview

10

Static

static

1

rat.bat

windows10-2004-x64

10

rat.bat

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    rat.bat
  • Size 14.4MB
  • Sample260125-xt65pafw5h
  • SHA256 30d7b66f11add0d1c1918ad1cb34622353e64c919cec7aff50ca4296cbe21499
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasarseroxendefense_evasiondiscoverypersistencespywaretrojan

Malware Config

Extracted

Family

  • quasar

Attributes
  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • reconnect_delay

    3000

Targets

    • Target
      rat.bat
    • Size 14.4MB
    • SHA256 30d7b66f11add0d1c1918ad1cb34622353e64c919cec7aff50ca4296cbe21499
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryquasarseroxenpersistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Seroxen family

      seroxen

    • Seroxen, Ser0xen

      Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

      trojanseroxen

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks