Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXE26b1fbf9671645449f015d5044e0376fQuasarRat
EXE[Rebuild from dump]_3e3f1ebc.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 7RWfQmhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port
Host fruitihuhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 7RWfQmhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 6huhuhuhu
Host ildriehuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 0NjuGahuhuhuhuhuhuhu
AuthKey VR7sJvhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Wihuhuhuhu
InstallName Updhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Windhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Chuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::ᵅ䜽㚘嬠౩⹜霯汆Ị텨梍䯉⨵牲珲烵욾(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 륖䣯텄ᒈ哥螉∠᷏韺ᴔፉ䆔瓧鍊雿::⚱쓳ⱡ▉ࢹ茲굓尾꯼繾兟笴쬘ꄓ骳㓩凙㝰()
brfalse.s IL_0040: call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
call System.Boolean 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::�ƭʭ㊈⠷܊웳糤搂킨緘⮴쮼᜾᷾卐⪱⟃怾滗()
brfalse.s IL_0040: call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
call System.Boolean 慥잰椹㯛〙齇落邃꣱뷖蓞턀姡둷崳�뉎�楝::get_Exiting()
brtrue.s IL_0040: call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
ldsfld 慥잰椹㯛〙齇落邃꣱뷖蓞턀姡둷崳�뉎�楝 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::피뵺嬧ず釕ɩ挅�ট⇽谊ᴴ旯�夛ﲭ
callvirt System.Void 慥잰椹㯛〙齇落邃꣱뷖蓞턀姡둷崳�뉎�楝::朓枸测嘸䶤՝붰퀞铱し蓹盲婪쿩讇霊숍❚똪()
call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::刵ఔ뫬ꋮ쪃跌硝擗㴮冿鐶筄⹃쵁傥滫젿銅()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::ᵅ䜽㚘嬠౩⹜霯汆Ị텨梍䯉⨵牲珲烵욾(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 륖䣯텄ᒈ哥螉∠᷏韺ᴔፉ䆔瓧鍊雿::⚱쓳ⱡ▉ࢹ茲굓尾꯼繾兟笴쬘ꄓ骳㓩凙㝰()
brfalse.s IL_0040: call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
call System.Boolean 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::�ƭʭ㊈⠷܊웳糤搂킨緘⮴쮼᜾᷾卐⪱⟃怾滗()
brfalse.s IL_0040: call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
call System.Boolean 慥잰椹㯛〙齇落邃꣱뷖蓞턀姡둷崳�뉎�楝::get_Exiting()
brtrue.s IL_0040: call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
ldsfld 慥잰椹㯛〙齇落邃꣱뷖蓞턀姡둷崳�뉎�楝 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::피뵺嬧ず釕ɩ挅�ট⇽谊ᴴ旯�夛ﲭ
callvirt System.Void 慥잰椹㯛〙齇落邃꣱뷖蓞턀姡둷崳�뉎�楝::朓枸测嘸䶤՝붰퀞铱し蓹盲婪쿩讇霊숍❚똪()
call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::⟯➳⮆嗘翴옍䜞巋‷펃劵ꇞ꾠몕㳼踥䲬苒↛㥌()
call System.Void 蛗뫆ḻ�䇺鬋컋ꢖ〙뛲됮㎹麎�Ꮟᬐ黯::刵ఔ뫬ꋮ쪃跌硝擗㴮冿鐶筄⹃쵁傥滫젿銅()
ret <null>
CnC CNCmalicious
ildriehuhuhuhuhuhuhu
Port PORTmalicious
6huhuhuhu
CnC CNCmalicious
fruitihuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙