Extracted

• • Target
    Naive Builder.bat
  • Size 12.8MB
  • SHA256 efd80dd8487437f58413be6e7d2da6ea866ae7626b3225dbf326e8c82c85e580
  • MD5 a2e3e4286e8b22b3b021a6706b899dd7
  • SHA1 e6179204735421c3927f27c13f9751af1dce9bd2
  • SHA512 3ff5d19accd1fa6765ffc3554bb9cfe3989eee4cf226c2ce7abbaff47a1586253ab1b408f4f9e47611ea7d2415f3298b12dfada1d1987d43c2efa16aac11e3e8
  • SSDEEP 49152:JZHKpAhg6/Ri76PuM0gcqQP+GBRa1SgA+754EU1kOeTUliFDvnrNqjdsusoj8nNc:e
  • TLSH
    T1EFD6D151362178A517A1A47BC3839EF67DAA0854767AC4926E9034CFB34E1226DF3CFC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  v15.6.3 | xencosturadefense_evasiondiscoveryquasarseroxenpackerpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2