Deep Malware Analysis of 12424064e68c62ea927e16acc4ec5e8f | md5: 12424064e68c62ea927e16acc4ec5e8f | .Net | PE (Portable Executable) | SOS: 0.32 | Executable | Managed .NET | PE File Layout | Win 32 Exe | x86 | RAT | Malicious | QuasarRat

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	12424064e68c62ea927e16acc4ec5e8f
Sha1	e4729cfea11996f63ce99a70658ece7d40017d2c
Sha256	9e40aacf77d0caed41a3670eaa817ae178493ccfdaf28875eaa0b16d7a63eb8b
Sha384	3d948c2d078cd4287024b516ee6da63397254a73b67fe6bf715c59caaf98f9e679d20c406f02ffcab9ed3971de23e74e
Sha512	7a2cdbdd3b67fab21e5eabb42974f7b20e7e56ffd9566a495fdc7b8d12ae88a91a93f1c92742a74a287ce808a68ee8c2de4506086d282fc280a88193c3d3d26d
SSDeep	12288:RTEgdfY8bgwSksQZukU4dJWz0eXIYcdL:SUwwf3Wz0eXlcdL
TLSH	7FF43A8093E8852AE5AF4B79E8311A1997F2FC36B5B2DB8F0D4674AD197F3034C41663

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:rsrc>bin

Shape pe:exe>pe:rsrc>bin

malicious 3 nodes

Path pe:exe>bin

Shape pe:exe>bin

malicious 2 nodes

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	342C1Ehuhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port	4huhuhuhu
Host	patri0huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	d8bfbfhuhuhuhuhuhuhuhuhuhuhu
StartupKey	dhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Offhuhuhuhu
LogDirectory	Lhuhuhuhu
ServerSignature	a79/fLhuhuhuhuhuhuhuhuhuhuhu
ServerCertificate	MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu
UnattendedMod	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::췬菡鍥刼뵾䣕촨㿌嶦扽橪Ꙗに暍㕣ဢ﹀岋㥈(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::൦卐꫟㶛迁씭ቄ갈Ｉ㗚콓龤絑ﻘ粑瀨鳍쮩⒵�(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 橽ᐣ⧆휸ﺳ恬伒⾏綫흉⛟谈ฅ컐ϸ旌꓁::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	Client
Full Name	Client
EntryPoint	System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::췬菡鍥刼뵾䣕촨㿌嶦扽橪Ꙗに暍㕣ဢ﹀岋㥈(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ⯭雔鐺眥籟뱮తꦂᄋ뮿욈車虞谜⪛讵닁::൦卐꫟㶛迁씭ቄ갈Ｉ㗚콓龤絑ﻘ粑瀨鳍쮩⒵�(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 橽ᐣ⧆휸ﺳ恬伒⾏綫흉⛟谈ฅ컐ϸ旌꓁::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

patri0huhuhuhuhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential