Malicious
Malicious

3bd028fd84572661084373eedd5319cd

Share on LinkedIn
Print
PE Executable
MD5: 3bd028fd84572661084373eedd5319cd
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 348 KB PE Executable identified by Malva.RE as QuasarRat (rat). Static analysis extracted 6 embedded or derived files, a malware configuration (QuasarRAT config.) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
36e185f1c669491893c7416e24a6d323f10730b7386ca204fd92266391b0d9e6
MD5
3bd028fd84572661084373eedd5319cd
Verdict
Malicious
File type
PE Executable · 348 KB
Family
QuasarRat
Category
RAT
C2 (defanged)
94[.]103[.]188[.]169

Cite this report: https://app.malva.re/sha256/36e185f1c669491893c7416e24a6d323f10730b7386ca204fd92266391b0d9e6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
356.35 KB · 356,352 B
First seen
2026-10-27 14:30 · 19 hours ago
Last seen
2026-10-27 14:30 · 19 hours ago
Last analysis
2026-10-27 14:30 · 19 hours ago
Hashes
MD5 3bd028fd84572661084373eedd5319cd Sha1 794e78d8fbdcee86870c667a7bb6f24bcb85a83f Sha256 36e185f1c669491893c7416e24a6d323f10730b7386ca204fd92266391b0d9e6 Sha384 3b6f64b5765f3037b2b34507af6d6c803694c6eea88781a3f6e9346f6e67f9d2ee18f2dbd83cc92c85daad74e956538f Sha512 48da09bbe788a48f698c4f0970d6b8cce337127762587cb23a675f6fe422232f1c43750d55171b49ee194786a3562e9c43c8d052096bb61aa956048619f73cc8 SSDeep 6144:i2NHXf500MGutUYMTAR3AM4mbaunwKgjeQBaO:Rd50pMTAWnuwQQBaO TLSH 63749D1373E4EA3BD1FD1736E4320A1A4BB4D857B616E38B5A5A64F92D133868D403B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

1 malicious · 7 files
EXE3bd028fd84572661084373eedd5319cdQuasarRat
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key MNk61ihuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 94.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey Quasarhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::鮪蜺徊븖ĝ넊㸥繲巹շ䦡睔Ɲﾆ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 根ﳐ⎷᐀탽᷵꓆옵䊍㚮᳟⫃﯈⣿䩮ㆌ놺┆㸲㖲::㥧컖ꨫ漭ᑚ誀뾇䋂㊡唋ᕇ䮺ꚜ㭿숎麗돔伦()
brfalse.s IL_0040: call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
call System.Boolean 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::䊌䎮Ʒ뚙౧踿㟲餕ဟ䖖芹錼ⱅ㳮ᑩ땴嬍厤ఴ()
brfalse.s IL_0040: call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
call System.Boolean 싍篒Ჵ盞見靴↶톟쵈明᫉䐙埑⊮间젔뫼ꨉ::get_Exiting()
brtrue.s IL_0040: call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
ldsfld 싍篒Ჵ盞見靴↶톟쵈明᫉䐙埑⊮间젔뫼ꨉ 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::䨓‟젶⻕侹ᑑ꼛鴕䆉ﴎ迩ᄊ䊊�ꈬ鎝쉱浨馺
callvirt System.Void 싍篒Ჵ盞見靴↶톟쵈明᫉䐙埑⊮间젔뫼ꨉ::㻧⺂骴�ौ됏ⲇ蹒慨�왆덺쿡쌄昔ᴺк()
call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::惂├륑ꘆ丮㎘ﱳ囬㣛ꕨ໬ퟮ춥쉤챕㶛ﷃ鸚()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::鮪蜺徊븖ĝ넊㸥繲巹շ䦡睔Ɲﾆ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 根ﳐ⎷᐀탽᷵꓆옵䊍㚮᳟⫃﯈⣿䩮ㆌ놺┆㸲㖲::㥧컖ꨫ漭ᑚ誀뾇䋂㊡唋ᕇ䮺ꚜ㭿숎麗돔伦()
brfalse.s IL_0040: call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
call System.Boolean 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::䊌䎮Ʒ뚙౧踿㟲餕ဟ䖖芹錼ⱅ㳮ᑩ땴嬍厤ఴ()
brfalse.s IL_0040: call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
call System.Boolean 싍篒Ჵ盞見靴↶톟쵈明᫉䐙埑⊮间젔뫼ꨉ::get_Exiting()
brtrue.s IL_0040: call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
ldsfld 싍篒Ჵ盞見靴↶톟쵈明᫉䐙埑⊮间젔뫼ꨉ 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::䨓‟젶⻕侹ᑑ꼛鴕䆉ﴎ迩ᄊ䊊�ꈬ鎝쉱浨馺
callvirt System.Void 싍篒Ჵ盞見靴↶톟쵈明᫉䐙埑⊮间젔뫼ꨉ::㻧⺂骴�ौ됏ⲇ蹒慨�왆덺쿡쌄昔ᴺк()
call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::툎羭쐰倦থ㸌㿇乤嶟럇ꅚⷸ萺�៩꠨䴄瓓()
call System.Void 왈⮁躲縙㇙䦋ࠚʏ⸌桲《ℛ萸㏑‛㲳嶿涕袺::惂├륑ꘆ丮㎘ﱳ囬㣛ꕨ໬ퟮ춥쉤챕㶛ﷃ鸚()
ret <null>

CnC CNCmalicious
94.1huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙