Malicious
Malicious

3eaba0343ac233e9bf7eba47deeb5b24

PE Executable
|
MD5: 3eaba0343ac233e9bf7eba47deeb5b24
|
Size: 376.84 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
 Hash Value
MD5
3eaba0343ac233e9bf7eba47deeb5b24
Sha1
3c8ecc3225a37db611ef9ef4db7b2f78b8fdd01d
Sha256
f4a0a365e6f6abe9956cf2f52ee5527b215774968e14fb9e2a02f015bc9bda50
Sha384
11c0be090875e9d2e914e05709abbdd1c053b687c7aa2723714afa799c90c93e0e0c090dad17696b8fee5b3afac03643
Sha512
9dd3cbfce7ae53818af9454fb206dd2f4a3d44e2a7b8f04215d795432c49ff4e8f01e408de2ffdf6d7691d37d030ec2078e84950bf9a23fa48ea342bbd800a88
SSDeep
6144:HrNHXf500MbKhECcCC+6m1QPbZBkvoDBR6LFbkYoUqa8vS:Ld50FKhECpC+mnHDBYLFv/qaaS
TLSH
93848C1337A8E63BD1FD173AF4320A194BB1D563B616E38B5A5A51BC2D233868D503B3

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
3eaba0343ac233e9bf7eba47deeb5b24
Malicious
[Rebuild from dump]_033b36c9.exe
Malicious
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Malware Configuration - QuasarRAT config.
Config. Field
 Value
Conf. AES-Salt

BF-EB-1E-56-FB-CD-97-3B-B2-19-02-24-30-A5-78-43-00-3D-56-44-D2-1E-62-B9-D4-F1-80-E7-E6-C3-39-41
Conf. AES-Key

VhXBMdlpMzEjsoLVukfp
Version

1.3.0.0
Port

warewuasar3.duck
Host

warewuasar3.duck
ReconnectDelay

3000
Key

1WvgEMPjdwfqIMeM9MclyQ==
AuthKey

NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==
SubDirectory

SubDir
InstallName

Client.exe
Install

0
Startup

0
Mutex

QSR_MUTEX_l1M93V
StartupKey

Quasar Client St
HideFile

0
EnableLogger

1
Tag

Proxy
LogDirectory

Logs
HideLogDirectory

1
HideLogSubdirectory

0
Informations
Name
 Value
Info

PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info

Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_033b36c9.exe
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.3.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

896
Main Method

System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Main IL Instruction Count

19
Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::朧्̛䦎雀튲솹ꅢῷ⡃ෲ�뫰揑☻⊛㶻(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 喃髾掎繑疑㗼枈옓�颶ᵟ媧퍡╳밝芧::ࠐ媭耡췡澎웘䅬㝒錊૆譩⠑靊昁箁䷘起妵罃() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ꂷᎊ漣鍈ﻷ꧶麴螯㸡鯿ﬗ﬑᰽뀌﷪쩢() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::get_Exiting() brtrue.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() ldsfld ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::㙉欼ㅩ쬀㊋囧驀ퟪ杅픆ￔ㜐屃沤줂䈷틁䟊 callvirt System.Void ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::﫽綳�᭡�念뉭憈鷎矅⨗ૂ㩈剅዆񁵟ụ꓆ű() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ኯⳐ砒찵웺榭霤珏⬗鋼ꖳ⡒ḻ戔鵾잣() ret <null>
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.3.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

896
Main Method

System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Main IL Instruction Count

19
Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::朧्̛䦎雀튲솹ꅢῷ⡃ෲ�뫰揑☻⊛㶻(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 喃髾掎繑疑㗼枈옓�颶ᵟ媧퍡╳밝芧::ࠐ媭耡췡澎웘䅬㝒錊૆譩⠑靊昁箁䷘起妵罃() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ꂷᎊ漣鍈ﻷ꧶麴螯㸡鯿ﬗ﬑᰽뀌﷪쩢() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::get_Exiting() brtrue.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() ldsfld ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::㙉欼ㅩ쬀㊋囧驀ퟪ杅픆ￔ㜐屃沤줂䈷틁䟊 callvirt System.Void ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::﫽綳�᭡�念뉭憈鷎矅⨗ૂ㩈剅዆񁵟ụ꓆ű() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ኯⳐ砒찵웺榭霤珏⬗鋼ꖳ⡒ḻ戔鵾잣() ret <null>
Artefacts
Name
 Value
CnC

warewuasar3.duck
Port

warewuasar3.duck
PE Layout

MemoryMapped (process dump suspected)
CnC

warewuasar3.duck
Port

warewuasar3.duck
PE Layout

MemoryMapped (process dump suspected)
3eaba0343ac233e9bf7eba47deeb5b24 (376.84 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙