Extracted

• • Target
    service.bat
  • Size 32.7MB
  • SHA256 1b73e3266247d73fb3ae5495713e9728d84723a3f03592c85f3f481617931e4a
  • MD5 6fc9048e6c7a994dd244556d59646210
  • SHA1 fd1c94454ffb484ba2b99b44a85ec47c16238aaa
  • SHA512 22ef48b4a5d5e84f695cb5bd70a138b7f0e658b1ca3bc04076d5805f9539240193b808d0e4504c688b01d0a1d00091a289c3d31c57ba0acdc0b143d47d6b5593
  • SSDEEP 98304:hyCtH+GIGcCAYTVAGLQCbbLkqfGTrKSdR1LUbcLBA95RP3ZuEmERamR/DmZ:hyVGIYBAG8CAqfGTrKSKIqn5pJbRamRg
  • TLSH
    T14577129B4D461B5F7A3E199E183DCF8B13532D38038E5ACA5B9074CE29EBB412B11D2D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  v15.4.5 | seroxendefense_evasiondiscoveryquasarseroxenpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft NirCmd

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2