Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXE1e9090349f01f39cbe780a4002ecf7ecQuasarRat
EXE[Rebuild from dump]_10de8af7.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key aLOO2Jhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port azharhuhuhuhuhuhuhu
Host azharhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory shuhuhuhu
InstallName sethuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Sthuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag shuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting()
brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ
callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting()
brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ
callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎()
ret <null>
CnC CNCmalicious
azharhuhuhuhuhuhuhu
Port PORTmalicious
azharhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙