Extracted

• • Target
    Uni.bat
  • Size 11.9MB
  • SHA256 0e013c02ca3509f58d26b374a60483ae9fd4470d9dd31fd86db476a143a2cd5b
  • MD5 62a3f0446d9cf1f52d49809254f7cb95
  • SHA1 099fc1d31f59b4284f9c7232622f16dc15364e3d
  • SHA512 b7f1afd1e273a978b04749d6737235056fd79d1fbb3102edbd6d1655fb7d049dfdb5d3785041fe0243aa44d045cacf127e94a1323da0664edf658a2a4d212911
  • SSDEEP 49152:FCOf0pZFG+xcONsf6hx4SvUnk7ZJDOG8YfJTBxlOuBCKneisu9DHXlwXUgmmdOd9:8
  • TLSH
    T185C6127E4D582D560A08DB2EA5E3185F37FAA94B0316A3F6FA5257077103B65E802F0F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionseroxenpersistencetrojanv3.0.0 | seroxenquasarspyware

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Seroxen family

    seroxen

  • Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  behavioral1behavioral2