Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 3 files
EXE4d0fedbf3e6923a0fdc5c0a3d7bdf23cQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key y1ajgdhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 172.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory michuhuhuhu
InstallName Updathuhuhuhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey servhuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag 2huhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::崙�䬲쌣荱틞鮃ቛ梋쳇䣗䞀뽄蟍⫳큑乌ᘖ菓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䵰﭂ﴄ夎ㄫ鮧ᅴ鴷칈ꑕﶝ璊縄㬈㒌⧣絛ೢ꺉::례ꥳ鸹暿ᷧ塆ੳ꛿薁얯㐤피鑰ꩱ㎪炅箉㐢()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::騥頎鳅㷑䪣衸뭏ퟫ砺�逮ꐆ㇍ဋﴲダ仯￸뺰()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::get_Exiting()
brtrue.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
ldsfld 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::뾶㢛ɛ篆燬弈ᢨ猌ྔ欌໰‣㶑꛽�t㶾�㟞
callvirt System.Void 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::鏼餰죅藛ꡖ㾹垑挅黉髧决攪敺髢욀쥑⯈嬘씌ಎ()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::滿➷⁸쮸Ž歋쓋갸ၲⰺ1䅔⮑㇨銃鎜�詶()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::崙�䬲쌣荱틞鮃ቛ梋쳇䣗䞀뽄蟍⫳큑乌ᘖ菓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䵰﭂ﴄ夎ㄫ鮧ᅴ鴷칈ꑕﶝ璊縄㬈㒌⧣絛ೢ꺉::례ꥳ鸹暿ᷧ塆ੳ꛿薁얯㐤피鑰ꩱ㎪炅箉㐢()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::騥頎鳅㷑䪣衸뭏ퟫ砺�逮ꐆ㇍ဋﴲダ仯￸뺰()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::get_Exiting()
brtrue.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
ldsfld 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::뾶㢛ɛ篆燬弈ᢨ猌ྔ欌໰‣㶑꛽�t㶾�㟞
callvirt System.Void 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::鏼餰죅藛ꡖ㾹垑挅黉髧决攪敺髢욀쥑⯈嬘씌ಎ()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::滿➷⁸쮸Ž歋쓋갸ၲⰺ1䅔⮑㇨銃鎜�詶()
ret <null>
CnC CNCmalicious
172.huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙