Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
1 malicious · 17 files
EXE24ba930e538a7a98bea076d0d46d3c8bQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key sV5YQUhuhuhuhuhuhuhu
Version 2.huhuhuhu
Port 4huhuhuhu
Host 127huhuhuhu
ReconnectDelay 3huhuhuhu
Key cfwy85huhuhuhuhuhuhu
SubDirectory fIv3ULhuhuhuhuhuhuhuhuhuhuhu
InstallName Suhuhuhuhu
Install Clihuhuhuhu
Startup 1huhuhuhu
Mutex 0huhuhuhu
StartupKey VNM_Mhuhuhuhuhuhuhu
HideFile Venomhuhuhuhuhuhuhu
EnableLogger 0huhuhuhu
EncryptionKey 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
$77-Venom.exe
Full Name
$77-Venom.exe
EntryPoint
System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::Main(System.String[])
Scope Name
$77-Venom.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
$77-Venom
Assembly Version
2.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
2085
Main Method
System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::Main(System.String[])
Main IL Instruction Count
21
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::ᛯ쑤揑᭷骓�⡠覂鹢筎㮛ୀ烡땑㾤�ꔻ૯(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 휮抄廅ⶰ佾�ꄛ匎뉺瀳࿌Ꜳ仜᜝댃廱酄㏋ﱾ::媽㧾멾涏䬀і뷐ﱁ됛痶农ꬭ㰭掠㨸횄ᐚ畓()
brfalse.s IL_0040: call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
call System.Boolean ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::闍셖⾗힏碫蟺␂멅籞脲Πའ帿定⚩頳熭赮()
brfalse.s IL_0040: call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
call System.Boolean 㗖㗑ୣ椔廔䲘ꖧ⼥복뭰욦ꛀ᝶뜏ﴺ梗㋬趱葰Ж::get_Exiting()
brtrue.s IL_0040: call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
ldsfld 㗖㗑ୣ椔廔䲘ꖧ⼥복뭰욦ꛀ᝶뜏ﴺ梗㋬趱葰Ж ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::ꐣడ�᪗Ɬ眩씉㐇�籇ꖰⱩ酩疧㕟�O�
callvirt System.Void 㗖㗑ୣ椔廔䲘ꖧ⼥복뭰욦ꛀ᝶뜏ﴺ梗㋬趱葰Ж::腜�犋끒斧ỿḙ쳭ሬ㜎䂈혁듆킈巬縋ぐ䄷()
call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
call System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::껣絨ᩙ⨌튋뙋ꞔ穮燾鉱ຫᧅᰊ㫚帺窢솎毤()
call System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::�趠嫋鞒鑔砆鴠槆悳룰ユ㡾㇒湗讠뭩ㄦ抜()
call System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::傚ঞ䮕�㖍먱霹㎽௶൤∁䇄摰磑㭣剦椻쀰瞎()
ret <null>
Module Name
$77-Venom.exe
Full Name
$77-Venom.exe
EntryPoint
System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::Main(System.String[])
Scope Name
$77-Venom.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
$77-Venom
Assembly Version
2.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
2085
Main Method
System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::Main(System.String[])
Main IL Instruction Count
21
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::ᛯ쑤揑᭷骓�⡠覂鹢筎㮛ୀ烡땑㾤�ꔻ૯(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 휮抄廅ⶰ佾�ꄛ匎뉺瀳࿌Ꜳ仜᜝댃廱酄㏋ﱾ::媽㧾멾涏䬀і뷐ﱁ됛痶农ꬭ㰭掠㨸횄ᐚ畓()
brfalse.s IL_0040: call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
call System.Boolean ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::闍셖⾗힏碫蟺␂멅籞脲Πའ帿定⚩頳熭赮()
brfalse.s IL_0040: call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
call System.Boolean 㗖㗑ୣ椔廔䲘ꖧ⼥복뭰욦ꛀ᝶뜏ﴺ梗㋬趱葰Ж::get_Exiting()
brtrue.s IL_0040: call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
ldsfld 㗖㗑ୣ椔廔䲘ꖧ⼥복뭰욦ꛀ᝶뜏ﴺ梗㋬趱葰Ж ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::ꐣడ�᪗Ɬ眩씉㐇�籇ꖰⱩ酩疧㕟�O�
callvirt System.Void 㗖㗑ୣ椔廔䲘ꖧ⼥복뭰욦ꛀ᝶뜏ﴺ梗㋬趱葰Ж::腜�犋끒斧ỿḙ쳭ሬ㜎䂈혁듆킈巬縋ぐ䄷()
call System.Void ⟖͸㡤坑귲崃�푡렑䮱㿈큮壟߈逤桲ꕟ::䙡⑏전ᔽ쾲滤ﵼ쾥᭠筸ꏆⶌ澺�ⷄ╞ư섕즟()
call System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::껣絨ᩙ⨌튋뙋ꞔ穮燾鉱ຫᧅᰊ㫚帺窢솎毤()
call System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::�趠嫋鞒鑔砆鴠槆悳룰ユ㡾㇒湗讠뭩ㄦ抜()
call System.Void ㈿랁룔↞⫣᪓셣國ࣽ俭툯㊦䂑恎ꯁࣟﺈ⏉::傚ঞ䮕�㖍먱霹㎽௶൤∁䇄摰磑㭣剦椻쀰瞎()
ret <null>
CnC CNCmalicious
127huhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙