Malicious
Malicious

4316ab3b11fdfeafa0078d24d3c19a2d

PE Executable
|
MD5: 4316ab3b11fdfeafa0078d24d3c19a2d
|
Size: 376.84 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
 Hash Value
MD5
4316ab3b11fdfeafa0078d24d3c19a2d
Sha1
8144edffd6c452b569ebe443202365a0e5d57339
Sha256
dda4c7cce263eef33608ddac3f32ee831454167df81cee3abe3c091f65709196
Sha384
27bad1d152fee004311bb2860bce4ef043eb967121b8688b3eabd8dccb543faffdb10ed3420811c8efe9548bb50166dd
Sha512
f2533b6f3c08b94dcd35b58d35d13e4a34dd36f88886fd7224cee6325339a631c26d190cdaf6349840d13d9daf65e0b9cd9eb3f25c9c185155f02095f043ab6a
SSDeep
6144:KfqQ4i1FFiEK82dhGHjXbeZbB3Wr21pfX8tAO:UplijOj0N5HfMtAO
TLSH
2E847C2377A4EA7BD2FD173AF4320A164BB0D5477612E38B5A5C65B82C133868D913B3

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
4316ab3b11fdfeafa0078d24d3c19a2d
Malicious
[Rebuild from dump]_a21920f3.exe
Malicious
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Malware Configuration - QuasarRAT config.
Config. Field
 Value
Conf. AES-Salt

BF-EB-1E-56-FB-CD-97-3B-B2-19-02-24-30-A5-78-43-00-3D-56-44-D2-1E-62-B9-D4-F1-80-E7-E6-C3-39-41
Conf. AES-Key

lF5PxY8V1p236LV8HPTx
Conf. AES-Salt

BF-EB-1E-56-FB-CD-97-3B-B2-19-02-24-30-A5-78-43-00-3D-56-44-D2-1E-62-B9-D4-F1-80-E7-E6-C3-39-41
Port

34.
Host

34.
Conf. AES-Key

lF5PxY8V1p236LV8HPTx
Version

1.3.0.0
Port

434
Host

windows10-11.duckdns.org
ReconnectDelay

2999
Key

oXCnUiPgBL0sy3Tlv+F8LQ==
AuthKey

h36LUNE6D6Y9hpohEF6YNS5bniF/Glgol+St+nwGv2QBfXWLmUsLx5aanXm2PRFz2aY54a//jMvBGR9l4hF9Vg==
SubDirectory

up
InstallName

jstat.exe
Install

0
Startup

0
Mutex

QSR_MUTEX_KGare8
StartupKey

Windows Protecte
HideFile

1
EnableLogger

1
Tag

200DocIP
LogDirectory

ogl
HideLogDirectory

0
HideLogSubdirectory

1
Informations
Name
 Value
Info

PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info

Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_a21920f3.exe
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.3.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

896
Main Method

System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Main IL Instruction Count

19
Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::⭢큆뿔퐊⧱襀⠑됹藸嶳隆烎᡻ἆꖹ怈夙(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean �퉃ሗꃚ헦㩉俼ീȟ风炄ꯣ冑ꤗ㼥::느塘脨᝕㶥㳸䜣참｛룺췚꼐Ꮒℎ쓩蓶瓷獌() brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() call System.Boolean ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::颮풨層赏貽⚢򷅔겦㏕䟷濱㉧뤫ᠱᬞ귗() brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() call System.Boolean 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::get_Exiting() brtrue.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() ldsfld 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥 ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::㒾晑穟ᰢ臥淎취㆐邬੕祜⭱ቌꢒ驳畲⩏㌋�蕶 callvirt System.Void 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::逿⡝搒ম꾿皎츳᭼꘮蚄湿奄靪᳸䩇�|⤹䇾() call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::箵྄�糄¤殜ﭟ췤帬䧆᲏⓶칫ꞛ굦鋢릓랁() ret <null>
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.3.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

896
Main Method

System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Main IL Instruction Count

19
Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::⭢큆뿔퐊⧱襀⠑됹藸嶳隆烎᡻ἆꖹ怈夙(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean �퉃ሗꃚ헦㩉俼ീȟ风炄ꯣ冑ꤗ㼥::느塘脨᝕㶥㳸䜣참｛룺췚꼐Ꮒℎ쓩蓶瓷獌() brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() call System.Boolean ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::颮풨層赏貽⚢򷅔겦㏕䟷濱㉧뤫ᠱᬞ귗() brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() call System.Boolean 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::get_Exiting() brtrue.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() ldsfld 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥 ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::㒾晑穟ᰢ臥淎취㆐邬੕祜⭱ቌꢒ驳畲⩏㌋�蕶 callvirt System.Void 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::逿⡝搒ম꾿皎츳᭼꘮蚄湿奄靪᳸䩇�|⤹䇾() call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼() call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::箵྄�糄¤殜ﭟ췤帬䧆᲏⓶칫ꞛ굦鋢릓랁() ret <null>
Artefacts
Name
 Value
CnC

windows10-11.duckdns.org
Port

434
CnC

34.
Port

34.
PE Layout

MemoryMapped (process dump suspected)
CnC

windows10-11.duckdns.org
Port

434
CnC

34.
Port

34.
PE Layout

MemoryMapped (process dump suspected)
4316ab3b11fdfeafa0078d24d3c19a2d (376.84 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙