Extracted

• • Target
    Rbx-Ping-Optimizer/Rbx-Ping-Optimizer/rbxpingoptimizer-Byfron/PingOptimizerMain.bat
  • Size 12.5MB
  • SHA256 ea1bc2bb1c3b3414811602bf9a462151b7f724daac0b8148abb3bfb6ae5283f6
  • MD5 3d2a9e403fda03c22310da085bf15ace
  • SHA1 366a1b2a5df84627817abb1741ca2aac86a4702f
  • SHA512 512ab99418bdfd9163a9b7ba35a3e48887cdd2371ec3017ee5b27dbec10246a9585215d3c112bc3c0d672a9f47c8409c5af58758df0fd63451bfec8318dc2ad5
  • SSDEEP 49152:wOpx0XZgEN6q+czPJBPJ48W5gRaEIZpktKjLW694LFHDsfmbYwmDLihiyaRJFxWr:C
  • TLSH
    T165D6C071B1422CDA9FD1888881C3C81F9FA24FB4AD7E44C9E74ED99BC00FEA5716D916
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  v2.2.6 | seroxencosturadefense_evasiondiscoveryexecutionquasarseroxenpackerpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Seroxen, Ser0xen

    Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

    trojanseroxen

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2