Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE47d75da2bf15d02eef967a1d4158b184QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key NDg4h4huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host 10huhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey xhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag xhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::᛹橕湹䢯⽾︄磃�姱䇈ᶐ禎⤼ꍥ睻䖓利�笌鿴(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ꉳￖ糪樓ꎋ擾擓퐚䩧૊☔傾♯쪌୙ﺸ͐::�ㆮ衬눳懫뒠兘齎ꆄ᪻᫩‽쵸栀㍵谏쨍佩青()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::ਜ왆镴붊摖韤ⅇ苒汀봝뉦딆낣Ἒ䳵()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::get_Exiting()
brtrue.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
ldsfld �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::䏫﮳猵큛붌麲㾻츧鲂縼陃ᄮࡏ퉤탫뵕旾裍처
callvirt System.Void �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::枰Ćபҕ⎡䄋萤ꨐ鯀寀时킊㶔㓇旻ﭪ덫䱰()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::蘴䏼ք紳跛嶂宎洋ﺌ⮫㱕蛎덐䲂ﳖ�()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::᛹橕湹䢯⽾︄磃�姱䇈ᶐ禎⤼ꍥ睻䖓利�笌鿴(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ꉳￖ糪樓ꎋ擾擓퐚䩧૊☔傾♯쪌୙ﺸ͐::�ㆮ衬눳懫뒠兘齎ꆄ᪻᫩‽쵸栀㍵谏쨍佩青()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::ਜ왆镴붊摖韤ⅇ苒汀봝뉦딆낣Ἒ䳵()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::get_Exiting()
brtrue.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
ldsfld �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::䏫﮳猵큛붌麲㾻츧鲂縼陃ᄮࡏ퉤탫뵕旾裍처
callvirt System.Void �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::枰Ćபҕ⎡䄋萤ꨐ鯀寀时킊㶔㓇旻ﭪ덫䱰()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::蘴䏼ք紳跛嶂宎洋ﺌ⮫㱕蛎덐䲂ﳖ�()
ret <null>
CnC CNCmalicious
10huhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙