Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: 1a0c632f7e9409efbca74245f8e99283
Size: 356.35 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
Hash Value
MD5
1a0c632f7e9409efbca74245f8e99283
Sha1
78554277391c28163255b456dd9bf40b39f9b31d
Sha256
92478c525daf58642a221dfda3782d6414d2040976fea242effffbdc854e813c
Sha384
d273195af8e9cbbaafa59d72ddcfd8189c9e81c533c36180a6f5ec4f6d6991655a7248b8498b790a6bfe3cf8f902bb0c
Sha512
0d5efd820343f524bd184467e33205ab348af2fdfa0ad21092982d41995ed5b2166099266e77fc9ab5bfd01811a7c47e925fcc58c7645ee98d182efd5d7862cd
SSDeep
6144:++NHXf500Mr5d2HIIIIIw9dVcXbRa/g2BxZKkZnwn6m8g2:1d50oG0jBxZKkZwn6m8g2
TLSH
A2748C1333A4E93BD1BE277AE03206154BB9D507B616E38F9A6855B82C533C68D913B3

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Malware Configuration - QuasarRAT config.
Config. Field
Value
Conf. AES-Salt
BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
eVC3EAhuhuhuhuhuhuhu
Version
1.huhuhuhu
Port
1huhuhuhu
Host
193.huhuhuhuhuhuhu
ReconnectDelay
3huhuhuhu
Key
1WvgEMhuhuhuhuhuhuhu
AuthKey
NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory
Suhuhuhuhu
InstallName
Clihuhuhuhu
Install
1huhuhuhu
Startup
0huhuhuhu
Mutex
QSR_Mhuhuhuhuhuhuhu
StartupKey
Quasahuhuhuhuhuhuhu
HideFile
0huhuhuhu
EnableLogger
0huhuhuhu
Tag
Ofhuhuhuhu
LogDirectory
Lhuhuhuhu
HideLogDirectory
0huhuhuhu
HideLogSubdirectory
0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

Client.exe

Full Name

Client.exe

EntryPoint

System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])

Scope Name

Client.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Client

Assembly Version

1.3.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0,Profile=Client

Total Strings

896

Main Method

System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])

Main IL Instruction Count

19

Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::㑥ͪ껼먈ꕜᶾ�Ǐ䗉䡍渥ྵ丵ﺧ槯過ꘓ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 떺䭈䒍뿣᳭鞯偛䂜聂順襧Ќꊃ麝�耋븄్ᝂ싔::‴ﻒ滭䒔捌ఫ袃꺓⃸ꅚ⪁얕햣詤젟�ញ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::氙旅䰣隖퐶釪ꛪⅮ爐ͪᾱ寘⧁ม䷅䊞ⳝ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::get_Exiting() brtrue.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() ldsfld ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉ �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::癤ືⷪ䜶ᬑ謹땁劙踝ࠚ寞ᖠᕑ뾏⤙ힴ鉉释㦘῔ callvirt System.Void ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::肒ղク窗➼뽂ퟖ獻짿㝆靅䀋ꮡ腤ﹺҠ䳍ꊓ朻() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::᥮⡆毂ʭԹ㐾㡧欼⓹띣ℬڤ승╲쉮ᘺ⡐濐쑏Ů() ret <null>

Module Name

Client.exe

Full Name

Client.exe

EntryPoint

System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])

Scope Name

Client.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Client

Assembly Version

1.3.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0,Profile=Client

Total Strings

896

Main Method

System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])

Main IL Instruction Count

19

Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::㑥ͪ껼먈ꕜᶾ�Ǐ䗉䡍渥ྵ丵ﺧ槯過ꘓ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 떺䭈䒍뿣᳭鞯偛䂜聂順襧Ќꊃ麝�耋븄్ᝂ싔::‴ﻒ滭䒔捌ఫ袃꺓⃸ꅚ⪁얕햣詤젟�ញ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::氙旅䰣隖퐶釪ꛪⅮ爐ͪᾱ寘⧁ม䷅䊞ⳝ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::get_Exiting() brtrue.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() ldsfld ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉ �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::癤ືⷪ䜶ᬑ謹땁劙踝ࠚ寞ᖠᕑ뾏⤙ힴ鉉释㦘῔ callvirt System.Void ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::肒ղク窗➼뽂ퟖ獻짿㝆靅䀋ꮡ腤ﹺҠ䳍ꊓ朻() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::᥮⡆毂ʭԹ㐾㡧欼⓹띣ℬڤ승╲쉮ᘺ⡐濐쑏Ů() ret <null>

Artefacts
Name
Value
CnC
193.huhuhuhuhuhuhu
Port
1huhuhuhu
Full artefact values (URLs, paths, registry keys…) are available with Essential.
Unlock with Essential
1a0c632f7e9409efbca74245f8e99283 (356.35 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙