Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE3ceb8483c59c15269da3fa43af0bc23bQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 0LACiVhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 6huhuhuhu
Host dnuhuhuhuhu
Conf. AES-Key 0LACiVhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 6huhuhuhu
Host www.huhuhuhuhuhuhu
Conf. AES-Key 0LACiVhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 6huhuhuhu
Host dnuhuhuhuhu
ReconnectDelay 5huhuhuhu
Key w1xN+/huhuhuhuhuhuhu
AuthKey ylWH3yhuhuhuhuhuhuhuhuhuhuhu
SubDirectory chuhuhuhu
InstallName hvhuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey hhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 0huhuhuhu
Tag ohuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::漿紵絇आ쪯勀ꦔ揃夘쐇䁭䄃幱듭〥刉뻵(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뇵籢⪩㽦兹쟊櫢篝㛆묉䌒溓弛쇇婞꥽琁�::ⲅ颩횃긲㣈ώ㎹蹖骪Җ댱㜃团댏犎吉↱()
brfalse.s IL_0040: call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
call System.Boolean ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::鄳鿛췷썷䎔ꯈ੔ﶿ跆뫁膿貦쒓ꠄ爒၄봸崌縛즛()
brfalse.s IL_0040: call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
call System.Boolean 듿쪏燚傩ꁟү쥯⤑硿蕅颉鰎杂ꞔ萇ꁇ밭뾁::get_Exiting()
brtrue.s IL_0040: call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
ldsfld 듿쪏燚傩ꁟү쥯⤑硿蕅颉鰎杂ꞔ萇ꁇ밭뾁 ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::慎룊隑뗩拲缤븘턼셢爆睪�쥝⽛刊옎藕Ꮴ뙠
callvirt System.Void 듿쪏燚傩ꁟү쥯⤑硿蕅颉鰎杂ꞔ萇ꁇ밭뾁::�磯쁀ﺀ怱䣼赬ྗ栛侪涼漟鯧롛ज睷퉑௩㽏()
call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::揄⺭紁ᏽ牙歴緭鈭归ꏅ嘭핻㌵⻅杭ᒚ誘()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::漿紵絇आ쪯勀ꦔ揃夘쐇䁭䄃幱듭〥刉뻵(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뇵籢⪩㽦兹쟊櫢篝㛆묉䌒溓弛쇇婞꥽琁�::ⲅ颩횃긲㣈ώ㎹蹖骪Җ댱㜃团댏犎吉↱()
brfalse.s IL_0040: call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
call System.Boolean ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::鄳鿛췷썷䎔ꯈ੔ﶿ跆뫁膿貦쒓ꠄ爒၄봸崌縛즛()
brfalse.s IL_0040: call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
call System.Boolean 듿쪏燚傩ꁟү쥯⤑硿蕅颉鰎杂ꞔ萇ꁇ밭뾁::get_Exiting()
brtrue.s IL_0040: call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
ldsfld 듿쪏燚傩ꁟү쥯⤑硿蕅颉鰎杂ꞔ萇ꁇ밭뾁 ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::慎룊隑뗩拲缤븘턼셢爆睪�쥝⽛刊옎藕Ꮴ뙠
callvirt System.Void 듿쪏燚傩ꁟү쥯⤑硿蕅颉鰎杂ꞔ萇ꁇ밭뾁::�磯쁀ﺀ怱䣼赬ྗ栛侪涼漟鯧롛ज睷퉑௩㽏()
call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::巯냎`쾪褲䈝䢰퓵ᗇሽ➄ד襑撆㇇佭ꏴ졹⨀䅥()
call System.Void ⼚⒁콭뱭嬅쮦餪�돯簫퍪클ᨎ饧겯蒬齷::揄⺭紁ᏽ牙歴緭鈭归ꏅ嘭핻㌵⻅杭ᒚ誘()
ret <null>
CnC CNCmalicious
dnuhuhuhuhu
Port PORTmalicious
6huhuhuhu
CnC CNCmalicious
www.huhuhuhuhuhuhu
Port PORTmalicious
6huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙