Extracted

• • Target
    Uni.bat
  • Size 10.4MB
  • SHA256 c4487ec16af20a4fd15e288a660c06f10f0a596b5bebe74a4be49dec5b43fa7a
  • MD5 aeaf633afdd7b8cc8881d078a3d8d1d4
  • SHA1 f894cf953216262c4c36fd330365695c932156e6
  • SHA512 469a4b40266251e0aa2618883fe45be369b5a46344a07daa92459b975eded0de63c53b327148e7f53732c0542d6052725898efc0e1d0aceb601fb80aba0d45e1
  • SSDEEP 49152:CknqDjNo45R2R2aXKlZ75wBAm+IdajETFmzcjAbLVIeHE9RGoxWAZSf74LTclNqd:N
  • TLSH
    T178B63370A9562E3543B8822429BFCD181DB11FB600C8FDD78D6194EB3C7F7462A16E6E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  v15.4.5 | seroxendefense_evasionquasarseroxenpersistencespywaretrojandiscovery

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Seroxen family

    seroxen

  • Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2