Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 3 files
EXE37530a5f60a84ed57746a93b153f0618QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key wdebSShuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host tickethuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 2huhuhuhu
Key cWW4/Shuhuhuhuhuhuhu
AuthKey kQVGglhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName svchuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey uphuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::퀴ꔟ뛭㫫ꪻ⹖ꉰ﷕�꼗늅玊ꞗ㜞뫓煛弝쓮칄(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ﭟ鷯ꔋ笆糨䂖펟洨ᮏ䌧賸괶䓁옴뛄芼䗖::ᕘ掤䁩쬐疇鸻댋⼠誗䒜๶폺ℬ䟧⋧쏛()
brfalse.s IL_0040: call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
call System.Boolean Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::┌ﰙ輁䘎쟝鎰ᠴ軱㷓硵┍˗Ų邝甾剢鷀嚔톑()
brfalse.s IL_0040: call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
call System.Boolean 逎⪦途丑₀뜎룒။抴诽伩㕒맓⒊⎣毥ޛ壡䔒::get_Exiting()
brtrue.s IL_0040: call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
ldsfld 逎⪦途丑₀뜎룒။抴诽伩㕒맓⒊⎣毥ޛ壡䔒 Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::坡 륱瀋䍡֣�ở葰酜큡썴鈻ဣ㭋ሙ
callvirt System.Void 逎⪦途丑₀뜎룒။抴诽伩㕒맓⒊⎣毥ޛ壡䔒::쉬㌾ﳣ枨Ṩ鄠䤩䝹몬༅ꆼ邨﨟鸁njﳶ⏲⼑㗠()
call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::㕎賔曹瑭쩥瘄案׼㨘㫔ꌄ쑁㪋㦽꧐糆䟯䏦()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::퀴ꔟ뛭㫫ꪻ⹖ꉰ﷕�꼗늅玊ꞗ㜞뫓煛弝쓮칄(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ﭟ鷯ꔋ笆糨䂖펟洨ᮏ䌧賸괶䓁옴뛄芼䗖::ᕘ掤䁩쬐疇鸻댋⼠誗䒜๶폺ℬ䟧⋧쏛()
brfalse.s IL_0040: call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
call System.Boolean Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::┌ﰙ輁䘎쟝鎰ᠴ軱㷓硵┍˗Ų邝甾剢鷀嚔톑()
brfalse.s IL_0040: call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
call System.Boolean 逎⪦途丑₀뜎룒။抴诽伩㕒맓⒊⎣毥ޛ壡䔒::get_Exiting()
brtrue.s IL_0040: call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
ldsfld 逎⪦途丑₀뜎룒။抴诽伩㕒맓⒊⎣毥ޛ壡䔒 Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::坡 륱瀋䍡֣�ở葰酜큡썴鈻ဣ㭋ሙ
callvirt System.Void 逎⪦途丑₀뜎룒။抴诽伩㕒맓⒊⎣毥ޛ壡䔒::쉬㌾ﳣ枨Ṩ鄠䤩䝹몬༅ꆼ邨﨟鸁njﳶ⏲⼑㗠()
call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::왺�曓ᢖ鵽噾駼伙釀ፂ笷՗鵿ꬷꈻ샭ꁱ㷃謁()
call System.Void Ꞁ䒨Ꜵ﫥煢뾐��鶚湨凝�蹰媤媂囝ᒎ໬許::㕎賔曹瑭쩥瘄案׼㨘㫔ꌄ쑁㪋㦽꧐糆䟯䏦()
ret <null>
CnC CNCmalicious
tickethuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙