Extracted

• • Target
    obf.bat
  • Size 12.5MB
  • SHA256 13dd2c4d58353b14afa8e28b6d344eec097b306bfc11c54955503fdd577da794
  • MD5 0836a9cdfe13f1f85ccd00aa626c7808
  • SHA1 056363fa764d2c4eef9027cd7b546a5db7b750f8
  • SHA512 2f23a850a0358424c1de8014924841f60f8dece783ddc19cc8396df58f80286547fb6897714ab5949074aeaef14f6936c04ecea4dc2d2d85d03cd813e5d9b85c
  • SSDEEP 49152:0B/923Ai6DBR0hAOBw0EWJYaiZFLaNBlQKPhYrg2qABYvSk166y74LzIO7YqenEQ:G
  • TLSH
    T141D6C09A2FEFA5A037C4747CB5F3A78D73B776732979A2B851F872904208D58B084748
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitv2.2.5 | seroxencosturadefense_evasiondiscoveryquasarseroxenpackerpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2