Deep Malware Analysis of 15e668ec8730d6e2cd82379190631dd1 | md5: 15e668ec8730d6e2cd82379190631dd1 | Html | RAT | Malicious | QuasarRat | Executable | PE (Portable Executable) | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.61 | Fody/Costura Packer | SOS: 0.20 | SOS: 0.22 | SOS: 0.23 | SOS: 0.34 | SOS: 0.29 | SOS: 0.35 | SOS: 0.19 | SOS: 0.25 | SOS: 0.14 | SOS: 0.26 | SOS: 0.32 | SOS: 0.27 | SOS: 0.18 | SOS: 0.15 | SOS: 0.24

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	15e668ec8730d6e2cd82379190631dd1
Sha1	914255d535ac0ed7f112a1d6a01580c7b86baca8
Sha256	06879f85dc934cf1d8074bbe94b9bc88e0eecdc325c9ac790195ff5225552bfd
Sha384	0e9d32a5d2de3263bb2ccaaf95a495206df8345079219d619e7893b3c327af8747bb5e15391e356b6a0c4143047a5f3e
Sha512	f0d59406c089e802b3739c6573486cda043719011be2205e1b71b4b808ad2b9ccf9021594d5d021273780c516224594d96ef2ff77de9d3378b9c1f95b33c7da5
SSDeep	24576:0rmegPOSueWBRrRREJNN0m8yXP8oc5R+NntqN0KK8i7yviUBQa2aOwIUyl2ZV2Dy:0rZuo7rRFirm+Nn42KK8i7Ltwa+VVaS
TLSH	D8950150B7F68116F1BF1BB9A4B704450B77BA139B3AC34E498CA09D1FA37409E613A7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void wdhsdfozbvlx.cl8xZTCeZ8fdLsdaA5BgyM::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1528
Main Method	System.Void wdhsdfozbvlx.cl8xZTCeZ8fdLsdaA5BgyM::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void wdhsdfozbvlx.cl8xZTCeZ8fdLsdaA5BgyM::9ViItRXCaDoX23tATZlwhdsYsoM() newobj System.Void wdhsdfozbvlx.8atKnDTh9LH::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void wdhsdfozbvlx.cl8xZTCeZ8fdLsdaA5BgyM::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1528
Main Method	System.Void wdhsdfozbvlx.cl8xZTCeZ8fdLsdaA5BgyM::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void wdhsdfozbvlx.cl8xZTCeZ8fdLsdaA5BgyM::9ViItRXCaDoX23tATZlwhdsYsoM() newobj System.Void wdhsdfozbvlx.8atKnDTh9LH::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

?huhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

?huhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

?huhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

protohuhuhuhuhuhuhu

PDB Path PATH

protobhuhuhuhuhuhuhu

PDB Path PATH

Shahuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

Sharphuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

/_/arthuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential