Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE0034a320fe20dfb830431c41c68abd79QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key FmsN70huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host lochuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Teshuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Teshuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::鈰ꥈ᪩锋糛ꡮم࿚촊ㅊ냬밧㲠ߜ䡅䃌찷(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 甩눭ꑔ눭ᳯ䡹伹⛴ͤ㪡�갗䧨甬➎쉩ฏꜽ::㠄缶舽䦴ꈖ繘ﱙՇ몾⪉䨊Ꮯ꽆돻絝⺕s侪䱏毼()
brfalse.s IL_0040: call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
call System.Boolean 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::牪ﰇ銲ᕔ鸉䜰䈂唖揠쁶ꮋ㝁榦Ⱝ�鿪迈()
brfalse.s IL_0040: call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
call System.Boolean 罎힖휷�꩗긽绽뼼葉撥媙땻ꛔ굺砘汸禜᪨::get_Exiting()
brtrue.s IL_0040: call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
ldsfld 罎힖휷�꩗긽绽뼼葉撥媙땻ꛔ굺砘汸禜᪨ 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::柿䢷뚃᪅潚ጯ爇✠Aᒚ勉觵ꥃ焹庰枎않⢏
callvirt System.Void 罎힖휷�꩗긽绽뼼葉撥媙땻ꛔ굺砘汸禜᪨::큒殱ᴏ鮥ꓱ댥炱撾鑁☂ᤡꏞ쓬χ竏胎�看춃ധ()
call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::巕봽芖邼Ꮋ棌粡渿脇븊⾇쉈熫�ј薚砑()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::鈰ꥈ᪩锋糛ꡮم࿚촊ㅊ냬밧㲠ߜ䡅䃌찷(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 甩눭ꑔ눭ᳯ䡹伹⛴ͤ㪡�갗䧨甬➎쉩ฏꜽ::㠄缶舽䦴ꈖ繘ﱙՇ몾⪉䨊Ꮯ꽆돻絝⺕s侪䱏毼()
brfalse.s IL_0040: call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
call System.Boolean 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::牪ﰇ銲ᕔ鸉䜰䈂唖揠쁶ꮋ㝁榦Ⱝ�鿪迈()
brfalse.s IL_0040: call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
call System.Boolean 罎힖휷�꩗긽绽뼼葉撥媙땻ꛔ굺砘汸禜᪨::get_Exiting()
brtrue.s IL_0040: call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
ldsfld 罎힖휷�꩗긽绽뼼葉撥媙땻ꛔ굺砘汸禜᪨ 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::柿䢷뚃᪅潚ጯ爇✠Aᒚ勉觵ꥃ焹庰枎않⢏
callvirt System.Void 罎힖휷�꩗긽绽뼼葉撥媙땻ꛔ굺砘汸禜᪨::큒殱ᴏ鮥ꓱ댥炱撾鑁☂ᤡꏞ쓬χ竏胎�看춃ധ()
call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::ᅢ羛䮯㖐廦ԏ땝�指酠阝㗲䨃褢癃邑Τ黏ᵿ()
call System.Void 狦忍胘╩Ⅶ＃⁵쩺쾲榡䙙芦亃厗儐跭笌昲::巕봽芖邼Ꮋ棌粡渿脇븊⾇쉈熫�ј薚砑()
ret <null>
CnC CNCmalicious
lochuhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙