Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE2727d658b37ad7696105970198e660c3QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 5iBEDyhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port windowhuhuhuhuhuhuhu
Host windowhuhuhuhuhuhuhu
Conf. AES-Key 5iBEDyhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host windowhuhuhuhuhuhuhu
ReconnectDelay 1huhuhuhu
Key oXCnUihuhuhuhuhuhuhu
AuthKey h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory uhuhuhuhu
InstallName updhuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey uphuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag HUhuhuhuhu
LogDirectory shuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::䘧韁䣖厳⎲錩ឍ磮㩌ۚᬮﲪ캔払ᾔ៶ʼ⹉픃䌉(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ፥演ℷ릁ཽ쁥苵麨褪戾凨컖뗁䲄悿臚ᶳ焇::�⡚횦⮅ꃈ➺ﳆ熁圭짎閞僸騌Ⲱ偐鋷甉팂⋯()
brfalse.s IL_0040: call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
call System.Boolean 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::⛋癉㱾噇ᾊ௳偿츘飛麎◭沴聇諤랋랋詻⬑䡚()
brfalse.s IL_0040: call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
call System.Boolean 틂煡ࠃ鄓햂戽໨峺�丱珱㿖诨�傿壏׺::get_Exiting()
brtrue.s IL_0040: call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
ldsfld 틂煡ࠃ鄓햂戽໨峺�丱珱㿖诨�傿壏׺ 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::⊿墳罞躍╹쏈㷆쫺쓇䉢⃊㭳ㅉ禔犕읢哳
callvirt System.Void 틂煡ࠃ鄓햂戽໨峺�丱珱㿖诨�傿壏׺::盌꙰飶쥗꠳ᙻ桾ﾈ㋉๤㋕륪䎯䳧듿〥ꌕ繘쉝()
call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::莟옱歡蘾벧謫�䥶驁૆줫᳞퉬柟〤⹻뮚ㆺ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::䘧韁䣖厳⎲錩ឍ磮㩌ۚᬮﲪ캔払ᾔ៶ʼ⹉픃䌉(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ፥演ℷ릁ཽ쁥苵麨褪戾凨컖뗁䲄悿臚ᶳ焇::�⡚횦⮅ꃈ➺ﳆ熁圭짎閞僸騌Ⲱ偐鋷甉팂⋯()
brfalse.s IL_0040: call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
call System.Boolean 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::⛋癉㱾噇ᾊ௳偿츘飛麎◭沴聇諤랋랋詻⬑䡚()
brfalse.s IL_0040: call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
call System.Boolean 틂煡ࠃ鄓햂戽໨峺�丱珱㿖诨�傿壏׺::get_Exiting()
brtrue.s IL_0040: call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
ldsfld 틂煡ࠃ鄓햂戽໨峺�丱珱㿖诨�傿壏׺ 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::⊿墳罞躍╹쏈㷆쫺쓇䉢⃊㭳ㅉ禔犕읢哳
callvirt System.Void 틂煡ࠃ鄓햂戽໨峺�丱珱㿖诨�傿壏׺::盌꙰飶쥗꠳ᙻ桾ﾈ㋉๤㋕륪䎯䳧듿〥ꌕ繘쉝()
call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::﵌篡垥溡�鎨១┬鎳颖鑿讐锫畮艉䐘⛹䊠⒙()
call System.Void 䫁㖝퀠樳鐾䘲焆鷷ಒ퇊鐧佐欺䩇㺢㹱像餣谉::莟옱歡蘾벧謫�䥶驁૆줫᳞퉬柟〤⹻뮚ㆺ()
ret <null>
CnC CNCmalicious
windowhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
windowhuhuhuhuhuhuhu
Port PORTmalicious
windowhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙