Deep Malware Analysis of 19bbb99253f9b87740ffee39d85eb931 | md5: 19bbb99253f9b87740ffee39d85eb931 | Html | RAT | Malicious | QuasarRat | Executable | PE (Portable Executable) | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.61 | Fody/Costura Packer | SOS: 0.20 | SOS: 0.22 | SOS: 0.23 | SOS: 0.34 | SOS: 0.29 | SOS: 0.35 | SOS: 0.25 | SOS: 0.14 | SOS: 0.26 | SOS: 0.32 | SOS: 0.27 | SOS: 0.18 | SOS: 0.15 | SOS: 0.24 | SOS: 0.19

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	19bbb99253f9b87740ffee39d85eb931
Sha1	c9c2b6fe04f9bf21aad061c5776367b3149d7553
Sha256	3637ca34ceee7b2a404aad80b80ac2e5da7ec008f03d55fa2ad662f5c93378f3
Sha384	c2a16b175a940918c8e60ae8c2cec35e50958eabd55d4217e2c1b657854737445018b3da681753f5e634fca9617c7aa2
Sha512	4cd7737cae50e49e9dd5c5fa97a5426a115e6a706b344bd0dc2c21d6533ea8c2ae85e5acb18fcf0e21a4e5c19eae934bcb33aab4550b3638e5308c3fba80ddd7
SSDeep	49152:vrZuw7rRFirm+Nn42KK8i7Ltwa+VVaSdT:vrZueavNnoK8i7LtwbHJd
TLSH	3F95F110B7F58116F1FF6BB9A8B708450B77B9029A3AC34F598CA09D1FA37409E513A7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1528
Main Method	System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::86GqGMIp8J() newobj System.Void cyefroqvfomximhrjpcjnvj.SYWMEpSm9Xzc::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.6.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	1528
Main Method	System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void cyefroqvfomximhrjpcjnvj.sb6S1OmC7t::86GqGMIp8J() newobj System.Void cyefroqvfomximhrjpcjnvj.SYWMEpSm9Xzc::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

PDB Path PATH

?huhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\Andhuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

?huhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

C:\Usehuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

protohuhuhuhuhuhuhu

PDB Path PATH

protobhuhuhuhuhuhuhu

PDB Path PATH

Shahuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

Sharphuhuhuhuhuhuhu

PDB Path PATH

SharpDhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

/_/arthuhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

E:\A\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

D:\a\_huhuhuhuhuhuhuhuhuhuhu

PDB Path PATH

?huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential