Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Symbol obfuscation
Medium
1 malicious · 7 files
EXE10fdb8304560bcfba5900d36bca7c379QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key fdVqQuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port rhuhuhuhu
Host rhuhuhuhu
Conf. AES-Key fdVqQuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host 127huhuhuhu
Conf. AES-Key fdVqQuhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host lochuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Thuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::癥ꂐ뙟�劎᡼׮螱�ꇎ쮹警蛗흑ꅥ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䋏궚ꖢ誽䆒뒚兘쿽碦ᕌ縟稩냂ⅵ邍铤濾ᙚꦩ::ᛢԈ⊍�Ⴅኝ䆐ତ䡐鹮뼣璆槛㢩曒갺Ⴔ놼惬⹢()
brfalse.s IL_0040: call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
call System.Boolean ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::䴀⣜㈮来瑧Ꜿ鱲慟⇰겿ማ쐳석ٟ䢾閔䥁䝙羨()
brfalse.s IL_0040: call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
call System.Boolean 铻鱃ﶪᨄ䄎痊ᄶᴓ翮�遴櫗ᘛゾ躸�᳠::get_Exiting()
brtrue.s IL_0040: call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
ldsfld 铻鱃ﶪᨄ䄎痊ᄶᴓ翮�遴櫗ᘛゾ躸�᳠ ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::鮾灱캣荃ἰ臘烵闕㱦羇浠퍠ϻ剁䤚邧なナ潌
callvirt System.Void 铻鱃ﶪᨄ䄎痊ᄶᴓ翮�遴櫗ᘛゾ躸�᳠::択瑚Ⱶוּ讹�畜搅⭺⢂婱鸯衻伷놜㻧풖ⓡ刅()
call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::鈀䣜昤犽큣釁鎐鶞ꉱ븍␧莡剒뽓㑕()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::癥ꂐ뙟�劎᡼׮螱�ꇎ쮹警蛗흑ꅥ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䋏궚ꖢ誽䆒뒚兘쿽碦ᕌ縟稩냂ⅵ邍铤濾ᙚꦩ::ᛢԈ⊍�Ⴅኝ䆐ତ䡐鹮뼣璆槛㢩曒갺Ⴔ놼惬⹢()
brfalse.s IL_0040: call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
call System.Boolean ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::䴀⣜㈮来瑧Ꜿ鱲慟⇰겿ማ쐳석ٟ䢾閔䥁䝙羨()
brfalse.s IL_0040: call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
call System.Boolean 铻鱃ﶪᨄ䄎痊ᄶᴓ翮�遴櫗ᘛゾ躸�᳠::get_Exiting()
brtrue.s IL_0040: call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
ldsfld 铻鱃ﶪᨄ䄎痊ᄶᴓ翮�遴櫗ᘛゾ躸�᳠ ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::鮾灱캣荃ἰ臘烵闕㱦羇浠퍠ϻ剁䤚邧なナ潌
callvirt System.Void 铻鱃ﶪᨄ䄎痊ᄶᴓ翮�遴櫗ᘛゾ躸�᳠::択瑚Ⱶוּ讹�畜搅⭺⢂婱鸯衻伷놜㻧풖ⓡ刅()
call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::橔䫻慆쿡ﰑ쌙娞畯穴龒翶�㿜ﾵ꺎理()
call System.Void ൮員赳ఄ䪍긆샣䡫ᐞꂉ鉾쫧새㬲ᛖ갴눬::鈀䣜昤犽큣釁鎐鶞ꉱ븍␧莡剒뽓㑕()
ret <null>
CnC CNCmalicious
lochuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
127huhuhuhu
CnC CNCmalicious
rhuhuhuhu
Port PORTmalicious
rhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙