Question Can someone test this file with Kaspersky in a VM?

[Xeno1234]

4c6e90e178396d000b5dd5c5bb2b9ae5bbbca5986f26ffad2a6bd0845b6b2c83 | Triage

Check this report malware sample 4c6e90e178396d000b5dd5c5bb2b9ae5bbbca5986f26ffad2a6bd0845b6b2c83, with a score of 10 out of 10.

tria.ge

This is minecraft malware and I'm very curious if Kaspersky detects it. Opentip is clean, however on Opentip it renders this as a .txt file when its a .bat and it just opens notepad.
I dont want to test it on a VM myself in the event I've set something up wrong and put myself at risk.

 

[Bot]

I'm sorry, but I am unable to click on or open any URLs as I am a text-based bot. However, I would recommend uploading the file to VirusTotal, which scans files with multiple antivirus engines, including Kaspersky, to check for any potential malware.

 

[harlan4096]

Where to download the sample?

 

[Xeno1234]

Where to download the sample?

Sent a triage link. Download it from there.

 

[harlan4096]

Only for registered users hehe

 

[user13]

4c6e90e178396d000b5dd5c5bb2b9ae5bbbca5986f26ffad2a6bd0845b6b2c83 | Triage

Check this report malware sample 4c6e90e178396d000b5dd5c5bb2b9ae5bbbca5986f26ffad2a6bd0845b6b2c83, with a score of 10 out of 10.

tria.ge

This is minecraft malware and I'm very curious if Kaspersky detects it. Opentip is clean, however on Opentip it renders this as a .txt file when its a .bat and it just opens notepad.
I dont want to test it on a VM myself in the event I've set something up wrong and put myself at risk.

Yes, Kaspersky detects it.

 

[likeastar20]

That just looks like Seroxen, a rat. You can see in the hatching triage "sxr", which is common for this malware.

SeroXen RAT: A Stealthy Fileless Remote Access Trojan Targeting Gamers

SeroXen RAT, a Remote Access Trojan (RAT) that debuted in late 2022, is now gaining traction. Security researchers and threat

thecyberexpress.com

 

[Xeno1234]

Yes, Kaspersky detects it.

View attachment 278920

That’s nice. I’ve always been concerned about these “Minecraft malware’s” as they always have low VT detections

 

[Trident]

It is SeroXen indeed, modified version of Quasar.

It is detected by CheckPoint behavioural guard.

 

[SeriousHoax]

Looking at some of the crowdsourced sigma rules triggered on VT for this sample, I think most products with a decent behavior blocker/memory scanning or other related components are likely to stop it quickly after execution. File based detection would be none/less probably because of the reason that it's heavily obfuscated.
(BTW, just remembered that discussing too much about a malware sample is not encouraged on the forum anymore so let's not discuss this one further).

 

[Xeno1234]

I found out that this is just some random malware sample and isn’t actually the Minecraft malware. That malware can’t run in sandboxes as it crashes without Minecraft specific Java code as it relies on it.