Extracted

• • Target
    SeroXen.rar
  • Size 7.4MB
  • SHA256 43b56573aa46b0a5c526e41ef58f0e902074181622a7b7508fa97c447b8afcc9
  • MD5 3e5e034189b129f8ffd7b6ae57982740
  • SHA1 a099319659a4852ee87219d15bd04606660a9afa
  • SHA512 578eec54ab0603ba4689590a181510e9aaf04bb3863f6283f19ff241f343ccd9cfbac8d35b7bcb65ece1d76122e0b808f90918ac468e3b4987717bd821c5b258
  • SSDEEP 196608:zSoEufZDDXsWegc13ygKrA8Uwsqew2k8ASGh/RHrw:zSoZDDXvcwrA8KkLB/hw
  • TLSH
    T14376337EEB19DC962F6007262B06A7370E7453A79EF21D2548C78FC79E178118A2AD31
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareseroxendefense_evasiondiscoveryexecutiondonutloaderquasarloaderspywaretrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1