Malicious
Malicious

4316ab3b11fdfeafa0078d24d3c19a2d

PE Executable
MD5: 4316ab3b11fdfeafa0078d24d3c19a2d
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
376.84 KB · 376,844 B
First seen
2025-11-23 01:02 · 11 months ago
Last seen
2025-11-23 01:02 · 11 months ago
Last analysis
2025-11-23 01:19 · 11 months ago
Hashes
MD5 4316ab3b11fdfeafa0078d24d3c19a2d Sha1 8144edffd6c452b569ebe443202365a0e5d57339 Sha256 dda4c7cce263eef33608ddac3f32ee831454167df81cee3abe3c091f65709196 Sha384 27bad1d152fee004311bb2860bce4ef043eb967121b8688b3eabd8dccb543faffdb10ed3420811c8efe9548bb50166dd Sha512 f2533b6f3c08b94dcd35b58d35d13e4a34dd36f88886fd7224cee6325339a631c26d190cdaf6349840d13d9daf65e0b9cd9eb3f25c9c185155f02095f043ab6a SSDeep 6144:KfqQ4i1FFiEK82dhGHjXbeZbB3Wr21pfX8tAO:UplijOj0N5HfMtAO TLSH 2E847C2377A4EA7BD2FD173AF4320A164BB0D5477612E38B5A5C65B82C133868D913B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXE4316ab3b11fdfeafa0078d24d3c19a2dQuasarRat
EXE[Rebuild from dump]_a21920f3.exeQuasarRat
BIN.Net Resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key lF5PxYhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 3huhuhuhu
Host 3huhuhuhu
Conf. AES-Key lF5PxYhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host windowhuhuhuhuhuhuhu
ReconnectDelay 2huhuhuhu
Key oXCnUihuhuhuhuhuhuhu
AuthKey h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory uhuhuhuhu
InstallName jsthuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Windohuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag 20huhuhuhu
LogDirectory ohuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::⭢큆뿔퐊⧱襀⠑됹藸嶳隆烎᡻ἆꖹ怈夙(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean �퉃ሗꃚ헦㩉俼ീȟ风炄ꯣ冑ꤗ㼥::느塘脨᝕㶥㳸䜣참｛룺췚꼐Ꮒℎ쓩蓶瓷獌()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::颮풨層赏貽⚢򷅔겦㏕䟷濱㉧뤫ᠱᬞ귗()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::get_Exiting()
brtrue.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
ldsfld 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥 ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::㒾晑穟ᰢ臥淎취㆐邬੕祜⭱ቌꢒ驳畲⩏㌋�蕶
callvirt System.Void 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::逿⡝搒ম꾿皎츳᭼꘮蚄湿奄靪᳸䩇�|⤹䇾()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::箵྄�糄¤殜ﭟ췤帬䧆᲏⓶칫ꞛ굦鋢릓랁()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::⭢큆뿔퐊⧱襀⠑됹藸嶳隆烎᡻ἆꖹ怈夙(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean �퉃ሗꃚ헦㩉俼ീȟ风炄ꯣ冑ꤗ㼥::느塘脨᝕㶥㳸䜣참｛룺췚꼐Ꮒℎ쓩蓶瓷獌()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::颮풨層赏貽⚢򷅔겦㏕䟷濱㉧뤫ᠱᬞ귗()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::get_Exiting()
brtrue.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
ldsfld 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥 ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::㒾晑穟ᰢ臥淎취㆐邬੕祜⭱ቌꢒ驳畲⩏㌋�蕶
callvirt System.Void 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::逿⡝搒ম꾿皎츳᭼꘮蚄湿奄靪᳸䩇�|⤹䇾()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::箵྄�糄¤殜ﭟ췤帬䧆᲏⓶칫ꞛ굦鋢릓랁()
ret <null>
CnC CNCmalicious
windowhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
3huhuhuhu
Port PORTmalicious
3huhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2 malicious · 6 files
EXE4316ab3b11fdfeafa0078d24d3c19a2dQuasarRat
EXE[Rebuild from dump]_a21920f3.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key lF5PxYhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 3huhuhuhu
Host 3huhuhuhu
Conf. AES-Key lF5PxYhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host windowhuhuhuhuhuhuhu
ReconnectDelay 2huhuhuhu
Key oXCnUihuhuhuhuhuhuhu
AuthKey h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory uhuhuhuhu
InstallName jsthuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Windohuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag 20huhuhuhu
LogDirectory ohuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
windowhuhuhuhuhuhuhu
4316ab3b11fdfeafa0078d24d3c19a2d
Port PORTmalicious
4huhuhuhu
4316ab3b11fdfeafa0078d24d3c19a2d
CnC CNCmalicious
3huhuhuhu
4316ab3b11fdfeafa0078d24d3c19a2d
Port PORTmalicious
3huhuhuhu
4316ab3b11fdfeafa0078d24d3c19a2d
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
4316ab3b11fdfeafa0078d24d3c19a2d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙