Malicious
Malicious

PE Executable
MD5: 359337df3d9dc4626f3584ff46a257d1
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
376.84 KB · 376,844 B
First seen
2025-11-23 00:50 · 11 months ago
Last seen
2025-11-23 00:50 · 11 months ago
Last analysis
2025-11-23 02:34 · 11 months ago
Hashes
MD5 359337df3d9dc4626f3584ff46a257d1 Sha1 c827d9237aa10e44cee83cb196be0a0b6502e20e Sha256 af6bee1b0900a4eb97a0ee72cbccc92396ca5ec119686b6b4908a0e8740b06b7 Sha384 f5d83ee7236a0d6402b65f7a16fc6ca8a46586bc978a8e04e99eac2770825438ac0fb4cd5190940f7bba4428325109b1 Sha512 8100276e060fad1f04b37863532ede968f9ef3375db44abe46979c57d71fe87d55a105d01964a0d6838db774ab1c98ae5b947dcc1fe1c135fcf130b15f53f464 SSDeep 6144:mrNHXf500MBcKLDipU4hAvNRUSbu+VWBRHrg/0u:Id50181XlPPHrgsu TLSH 3D849D1373A8E93BD1FE173AF43606194BB1D423B612E38B5A5A55BC2D233868D513B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXE359337df3d9dc4626f3584ff46a257d1QuasarRat
EXE[Rebuild from dump]_6a551fe4.exeQuasarRat
BIN.Net Resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key Rsz1tYhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port hard-huhuhuhuhuhuhu
Host hard-huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Kuhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::籚ನᄀ⌨﷧ⴲᬭ豺꧜뗋ᛙ엢㜻〓풼돓౮袀ﲷ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ␰䰯꒛蒜瓅䶊視᳆怅鉗㹗퀮ꕊ垍૏쭀඙嶐㾖ꭆ::폪픆嗘▜넹휕歘ﰆ윘榜ﴹ㚧巒ⱚ�肶⸚繤ꈙ()
brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
call System.Boolean 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::컉à侂寊�◜괿䚡텂緜悒㼯赎筥扮爗()
brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
call System.Boolean ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::get_Exiting()
brtrue.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
ldsfld ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::︨⩮깛諾圵젙狋톊炔ꇓ礞绋뻣ᷚ萿̦器袻
callvirt System.Void ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::ﶽ歑蝳逌ﱐ䍣質뒲௻ꤧﻝ뿹�꿩슩꧆벝ꃥퟹҺ()
call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::璭�먪鈯铫㦢렫ꛪ쓩쫹軂ꌵᶐ噫ꐍ㧡쮈⮫ሃ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::籚ನᄀ⌨﷧ⴲᬭ豺꧜뗋ᛙ엢㜻〓풼돓౮袀ﲷ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ␰䰯꒛蒜瓅䶊視᳆怅鉗㹗퀮ꕊ垍૏쭀඙嶐㾖ꭆ::폪픆嗘▜넹휕歘ﰆ윘榜ﴹ㚧巒ⱚ�肶⸚繤ꈙ()
brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
call System.Boolean 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::컉à侂寊�◜괿䚡텂緜悒㼯赎筥扮爗()
brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
call System.Boolean ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::get_Exiting()
brtrue.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
ldsfld ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::︨⩮깛諾圵젙狋톊炔ꇓ礞绋뻣ᷚ萿̦器袻
callvirt System.Void ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::ﶽ歑蝳逌ﱐ䍣質뒲௻ꤧﻝ뿹�꿩슩꧆벝ꃥퟹҺ()
call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯()
call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::璭�먪鈯铫㦢렫ꛪ쓩쫹軂ꌵᶐ噫ꐍ㧡쮈⮫ሃ()
ret <null>
CnC CNCmalicious
hard-huhuhuhuhuhuhu
Port PORTmalicious
hard-huhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2 malicious · 6 files
EXE359337df3d9dc4626f3584ff46a257d1QuasarRat
EXE[Rebuild from dump]_6a551fe4.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key Rsz1tYhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port hard-huhuhuhuhuhuhu
Host hard-huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Kuhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
hard-huhuhuhuhuhuhu
359337df3d9dc4626f3584ff46a257d1
Port PORTmalicious
hard-huhuhuhuhuhuhu
359337df3d9dc4626f3584ff46a257d1
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
359337df3d9dc4626f3584ff46a257d1
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙