Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 1 file
EXE16b468133379830504f1f0796a02000aQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key f6x51ghuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 6huhuhuhu
Host goldbohuhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key f6x51ghuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 6huhuhuhu
Host goldgohuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key Ria/sJhuhuhuhuhuhuhu
AuthKey gIZSCRhuhuhuhuhuhuhuhuhuhuhu
SubDirectory thuhuhuhu
InstallName trhuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey ohuhuhuhu
HideFile 1huhuhuhu
EnableLogger 0huhuhuhu
Tag Ahuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::輋໳梴衻텅笩疤碰톖魢䋇厨ᨲ踣嚺℃幻豪(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⅾ퐳૷땨♬갺�䡑鉭抰䠄�籯娾휕脑䫂蜏::뇎㔗䊊紱⻗ᑝ㻏㒙伏ֶ䆵�汖凪䦺೩⇠퇲鞜()
brfalse.s IL_0040: call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
call System.Boolean 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::❕렑옅桩ᘇ혰ꅯ䐹J簬塝釢둱嬒䦊灮걦ᾡྂ찋()
brfalse.s IL_0040: call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
call System.Boolean ୉ͩ鯶뷉�㻂Ḷ똯ᯃ睵뽿覴Ṫ笽䄟쫶룂::get_Exiting()
brtrue.s IL_0040: call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
ldsfld ୉ͩ鯶뷉�㻂Ḷ똯ᯃ睵뽿覴Ṫ笽䄟쫶룂 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::ᷬ楚臌곿{蘆櫱䇓颷≨蕊甀鏳꛵붰Ɔ摩
callvirt System.Void ୉ͩ鯶뷉�㻂Ḷ똯ᯃ睵뽿覴Ṫ笽䄟쫶룂::ꅻ⹁ᆩꐮ졝枈ᣝ끦ᒰᢛ蓫뱵DŽ⤜澕()
call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::ㆿ梞Ⴛ꘍㘵࢟廍亁穗춬퉋Ờ뀬ּ蔡榃飅()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::輋໳梴衻텅笩疤碰톖魢䋇厨ᨲ踣嚺℃幻豪(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⅾ퐳૷땨♬갺�䡑鉭抰䠄�籯娾휕脑䫂蜏::뇎㔗䊊紱⻗ᑝ㻏㒙伏ֶ䆵�汖凪䦺೩⇠퇲鞜()
brfalse.s IL_0040: call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
call System.Boolean 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::❕렑옅桩ᘇ혰ꅯ䐹J簬塝釢둱嬒䦊灮걦ᾡྂ찋()
brfalse.s IL_0040: call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
call System.Boolean ୉ͩ鯶뷉�㻂Ḷ똯ᯃ睵뽿覴Ṫ笽䄟쫶룂::get_Exiting()
brtrue.s IL_0040: call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
ldsfld ୉ͩ鯶뷉�㻂Ḷ똯ᯃ睵뽿覴Ṫ笽䄟쫶룂 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::ᷬ楚臌곿{蘆櫱䇓颷≨蕊甀鏳꛵붰Ɔ摩
callvirt System.Void ୉ͩ鯶뷉�㻂Ḷ똯ᯃ睵뽿覴Ṫ笽䄟쫶룂::ꅻ⹁ᆩꐮ졝枈ᣝ끦ᒰᢛ蓫뱵DŽ⤜澕()
call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::䙣କ냺믹毝씗댢껒꯼금げだ᚜灪鞂뺥鷝鯭()
call System.Void 漢�莫퍵섛됌᝱ⲧ艐¿픧앆峠�Ȟ鄶监䀦::ㆿ梞Ⴛ꘍㘵࢟廍亁穗춬퉋Ờ뀬ּ蔡榃飅()
ret <null>
CnC CNCmalicious
goldgohuhuhuhuhuhuhu
Port PORTmalicious
6huhuhuhu
CnC CNCmalicious
goldbohuhuhuhuhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙