Malicious
Malicious

2ac1f830806ce3bdd35cdcb957f139ba

PE Executable
MD5: 2ac1f830806ce3bdd35cdcb957f139ba
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
356.35 KB · 356,352 B
First seen
2026-07-28 07:02 · 3 months ago
Last seen
2026-07-28 07:02 · 3 months ago
Last analysis
2026-07-28 07:02 · 3 months ago
Hashes
MD5 2ac1f830806ce3bdd35cdcb957f139ba Sha1 00f6a68fef995c15c116c48b18d9611db036c1e5 Sha256 9270d36aa57eec3d44dc2d66929551198cb8a31d0ef383a726c38b75ad8144ba Sha384 5f1afa68bc650399116d6b3ae215c93b3a389244ad3cc5796e0c388f74c7b8b556b4e3aec54e1286ac307621162cd6b3 Sha512 5eca9c6f9be362f4ca7a7c5e7b5e8e9c8ba1b46558575b2703de982dbcc2a61b1cf5e7af3c292e4cb745994dcd1198cf0dd50648f1dcd5f82aefc310e49b061d SSDeep 6144:kzNHXf500MbHkuNarU5bX1z0oaGMHAM2S06:ud509kuNAUl1zEGMHAI06 TLSH E1747C1373A8D67BD1BE173BE53206056BB0D407B712E38B5A6855BCAC123868D91BF3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE2ac1f830806ce3bdd35cdcb957f139baQuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key a8O1Ybhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 91.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey Quasarhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::觤궄뢎舯ꆈ陂ﻗ誂邥짶㠢边⃠敡췐엙싌쉱꽟(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 喁⴫놰귺顉�얼赤풾踂䳡薟즇껀눳픠颢::籩㞠쑁犄⮴帍⎎鸏삐堂뙸Ⰼ쳔⬖䱆痙㶜붫ⷼ()
brfalse.s IL_0040: call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
call System.Boolean 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::꒞丙㲧퐰徘⢰ⓖ詉쏤뮞呾簡�伪潯졷鼏ᷖ()
brfalse.s IL_0040: call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
call System.Boolean ⭙໱軽靊ሹꔼ죽糯㊫㿶ᑔ汲愭㳄辒�Ჾ횪::get_Exiting()
brtrue.s IL_0040: call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
ldsfld ⭙໱軽靊ሹꔼ죽糯㊫㿶ᑔ汲愭㳄辒�Ჾ횪 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::題뎔ទਸৢ뤒ঁ띌࿧䬇漽띏嶁㝒둱䁄검
callvirt System.Void ⭙໱軽靊ሹꔼ죽糯㊫㿶ᑔ汲愭㳄辒�Ჾ횪::쾹ｌ鶫䎀䒟会Ɇ᧭绂쬞삘ℰ㯆季勒멐煅ꇎDZ()
call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::ﱈᙼ왖迧ؗ㈌뤤ꦬ﷝쒷뭩岵ꁛ뮔鬶䎌찲()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::觤궄뢎舯ꆈ陂ﻗ誂邥짶㠢边⃠敡췐엙싌쉱꽟(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 喁⴫놰귺顉�얼赤풾踂䳡薟즇껀눳픠颢::籩㞠쑁犄⮴帍⎎鸏삐堂뙸Ⰼ쳔⬖䱆痙㶜붫ⷼ()
brfalse.s IL_0040: call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
call System.Boolean 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::꒞丙㲧퐰徘⢰ⓖ詉쏤뮞呾簡�伪潯졷鼏ᷖ()
brfalse.s IL_0040: call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
call System.Boolean ⭙໱軽靊ሹꔼ죽糯㊫㿶ᑔ汲愭㳄辒�Ჾ횪::get_Exiting()
brtrue.s IL_0040: call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
ldsfld ⭙໱軽靊ሹꔼ죽糯㊫㿶ᑔ汲愭㳄辒�Ჾ횪 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::題뎔ទਸৢ뤒ঁ띌࿧䬇漽띏嶁㝒둱䁄검
callvirt System.Void ⭙໱軽靊ሹꔼ죽糯㊫㿶ᑔ汲愭㳄辒�Ჾ횪::쾹ｌ鶫䎀䒟会Ɇ᧭绂쬞삘ℰ㯆季勒멐煅ꇎDZ()
call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::‾뚨⮶俗娯耄㻜쬉⻯烢㡊ﳯ鸉勶䜠ｇ()
call System.Void 簾뾒㒹뀒뙏⩍綴ਓ闏튔亷麢脄㋺᫬뻥䓻::ﱈᙼ왖迧ؗ㈌뤤ꦬ﷝쒷뭩岵ꁛ뮔鬶䎌찲()
ret <null>
CnC CNCmalicious
91.1huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 7 files
EXE2ac1f830806ce3bdd35cdcb957f139baQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key a8O1Ybhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 91.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey Quasarhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
91.1huhuhuhuhuhuhu
2ac1f830806ce3bdd35cdcb957f139ba
Port PORTmalicious
1huhuhuhu
2ac1f830806ce3bdd35cdcb957f139ba
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙