Malicious
Malicious

16cc3e926a3ae25ff5e54c234f0a76fa

PE Executable
MD5: 16cc3e926a3ae25ff5e54c234f0a76fa
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
376.84 KB · 376,844 B
First seen
2025-11-23 01:02 · 11 months ago
Last seen
2025-11-23 01:02 · 11 months ago
Last analysis
2025-11-23 01:04 · 11 months ago
Hashes
MD5 16cc3e926a3ae25ff5e54c234f0a76fa Sha1 e1b411b92b8936fb0960a372d817e913512c6bfd Sha256 df36a38c7a47121fe7d7768163fd916fb3d1de9b8ed5e02ac040706cb2ccae8a Sha384 c32d9a9e57f2b6d06175f26c77bb0738af58c7572207498db9b81a6af146f5b6880d709a8d71a4d000e9526b8eec81f0 Sha512 bb35a5d6798187a94a0c440657dac9033c81063aa696b6e8113175b801bae42194f235a34a4e030a5c6e2cab5829dcfb9b02e295e91d660273b3ef17ac7a02c5 SSDeep 6144:hLNHXf500MVn2ghtrJ1Db6oiKTfQzwFJPSCu:dd50DThxJ1iTKTozOJPju TLSH 87848D13B7A4E93BD1FD1B3AE43207155BB0D587B616E38B6A5845BC2E133868E503B3
Detection
PeID
Microsoft Visual C# / Basic .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXE16cc3e926a3ae25ff5e54c234f0a76faQuasarRat
EXE[Rebuild from dump]_d612a122.exeQuasarRat
BIN.Net Resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 1wnC7chuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 6huhuhuhu
Host 172.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag qhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::�⚥氳࿤侅렧ส麁祣皴ㅔ耊䀦攍ᕪ韴簗�(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䃵৽雗㩝�㙸栗결⿀탙匽η郏퐨鯴䠳‏僫::譥⡑⢷䕱�賊傞裚炿⸀쪳⾓얶ᶣ⎈��()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ಳ볷㴕嵏ค㶤贗訹灷갖༥鳟�骏䦠㦅鮟徲쵪()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::get_Exiting()
brtrue.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
ldsfld ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门 ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::獏䷵⻛ĩຏ誊䂊㊡勤๬눵鐆액£늽ᔍ�푆
callvirt System.Void ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::쨔奨ي쮍鈜睃꣞鱊㬉쑢쭠眆됄崫걱Ш꼡ﻐ꘦()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::癥섹柪☎쫻푦鋓㐄˱韺㋚♇炕㨰螾Ⴀណꐅ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::�⚥氳࿤侅렧ส麁祣皴ㅔ耊䀦攍ᕪ韴簗�(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䃵৽雗㩝�㙸栗결⿀탙匽η郏퐨鯴䠳‏僫::譥⡑⢷䕱�賊傞裚炿⸀쪳⾓얶ᶣ⎈��()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ಳ볷㴕嵏ค㶤贗訹灷갖༥鳟�骏䦠㦅鮟徲쵪()
brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Boolean ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::get_Exiting()
brtrue.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
ldsfld ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门 ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::獏䷵⻛ĩຏ誊䂊㊡勤๬눵鐆액£늽ᔍ�푆
callvirt System.Void ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::쨔奨ي쮍鈜睃꣞鱊㬉쑢쭠眆됄崫걱Ш꼡ﻐ꘦()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩()
call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::癥섹柪☎쫻푦鋓㐄˱韺㋚♇炕㨰螾Ⴀណꐅ()
ret <null>
CnC CNCmalicious
172.huhuhuhuhuhuhu
Port PORTmalicious
6huhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2 malicious · 6 files
EXE16cc3e926a3ae25ff5e54c234f0a76faQuasarRat
EXE[Rebuild from dump]_d612a122.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 1wnC7chuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 6huhuhuhu
Host 172.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag qhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
172.huhuhuhuhuhuhu
16cc3e926a3ae25ff5e54c234f0a76fa
Port PORTmalicious
6huhuhuhu
16cc3e926a3ae25ff5e54c234f0a76fa
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
16cc3e926a3ae25ff5e54c234f0a76fa
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙