Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE08b25d1a43da6be7f45ba160d0383cc3QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key WGgtk6huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 5.tcphuhuhuhuhuhuhu
Host 5.tcphuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey svhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::땒༯쌬枎菉ࡌ갯躅へ⮣櫲Ώ紩炼甅龜샒(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 欬嘉㙋ꥅ侄洂㊡䐕Ⲝ䤘凐黉첉뜺粒풐꼯ꅝ::ⅸ从映䊵哔﹑ꓮᢳ䔶畁炄歹릘咗ホ쎒뜲䢁謍()
brfalse.s IL_0040: call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
call System.Boolean 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::溣껏㇌짒㟾쫛☇Փ஫፝䣼�患࣠헔囫れ쬴妑흫()
brfalse.s IL_0040: call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
call System.Boolean ⑾䞙拾怱펱忴䵖ꕢᢁᩛ淤氷䛵⡊::get_Exiting()
brtrue.s IL_0040: call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
ldsfld ⑾䞙拾怱펱忴䵖ꕢᢁᩛ淤氷䛵⡊ 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::솤➘ൕ◥換램鳤醜晿铐㺕톷怪롩滎ដ뱦皩ῆ
callvirt System.Void ⑾䞙拾怱펱忴䵖ꕢᢁᩛ淤氷䛵⡊::Ɔ܅쯒햚꼽䋞䑷꣕⻈ꍶ官왳淝㴚䮒햪ꍨ﫾()
call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::૗쾭냊쬪긛싩⸙ᶦᔣ耭ㆮ♊瀞賸梁⋓ȅ눰�()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::땒༯쌬枎菉ࡌ갯躅へ⮣櫲Ώ紩炼甅龜샒(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 欬嘉㙋ꥅ侄洂㊡䐕Ⲝ䤘凐黉첉뜺粒풐꼯ꅝ::ⅸ从映䊵哔﹑ꓮᢳ䔶畁炄歹릘咗ホ쎒뜲䢁謍()
brfalse.s IL_0040: call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
call System.Boolean 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::溣껏㇌짒㟾쫛☇Փ஫፝䣼�患࣠헔囫れ쬴妑흫()
brfalse.s IL_0040: call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
call System.Boolean ⑾䞙拾怱펱忴䵖ꕢᢁᩛ淤氷䛵⡊::get_Exiting()
brtrue.s IL_0040: call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
ldsfld ⑾䞙拾怱펱忴䵖ꕢᢁᩛ淤氷䛵⡊ 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::솤➘ൕ◥換램鳤醜晿铐㺕톷怪롩滎ដ뱦皩ῆ
callvirt System.Void ⑾䞙拾怱펱忴䵖ꕢᢁᩛ淤氷䛵⡊::Ɔ܅쯒햚꼽䋞䑷꣕⻈ꍶ官왳淝㴚䮒햪ꍨ﫾()
call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::둷ῧ甩⇏퐣犘⶝읖伆鱱㼪✀逬탟沾ᓜ꼀鱤()
call System.Void 䌞ꈋ펑閚䞴앱㑫焒펴⬣澾ბ�೰판熞竩綴::૗쾭냊쬪긛싩⸙ᶦᔣ耭ㆮ♊瀞賸梁⋓ȅ눰�()
ret <null>
CnC CNCmalicious
5.tcphuhuhuhuhuhuhu
Port PORTmalicious
5.tcphuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙