Malicious
Malicious

4dfaee309a8515c5531855ae8184fc71

Share on LinkedIn
Print
PE Executable
MD5: 4dfaee309a8515c5531855ae8184fc71
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 348 KB PE Executable identified by Malva.RE as QuasarRat (rat). Static analysis extracted 6 embedded or derived files, a malware configuration (QuasarRAT config.) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bd29b8106ffdde93f23674752ecbbc143b5b92ea7c6f85a2cebc033dbe9eabe6
MD5
4dfaee309a8515c5531855ae8184fc71
Verdict
Malicious
File type
PE Executable · 348 KB
Family
QuasarRat
Category
RAT
C2 (defanged)
85[.]121[.]5[.]9

Cite this report: https://app.malva.re/sha256/bd29b8106ffdde93f23674752ecbbc143b5b92ea7c6f85a2cebc033dbe9eabe6

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
356.35 KB · 356,352 B
Hashes
MD5 4dfaee309a8515c5531855ae8184fc71 Sha1 48a459dd899592afc0dec343d88ca7d85ffcc909 Sha256 bd29b8106ffdde93f23674752ecbbc143b5b92ea7c6f85a2cebc033dbe9eabe6 Sha384 cdecebfe4392f0bba3624ee7c75ddb8ef168afe6a5a5434edb061d9fa22b47753b683b7aac5b470edff9af4c76fd7e1e Sha512 8a296f870776480e50adb68e8ff36adfef8afa3d57ee047e185fbe11aa32e1261c5c37987d9fd2d4aa0d622d03395a50139613338d7f99d621bd9c14e4cc1111 SSDeep 6144:k2NHXf500M/ILaZjBtMsdeubah/uoVDDmMeAq4WQG:rd50njBtMfXYMnmMeAqAG TLSH 91748D1373A8D57BD1FE2B3AE43206094BB0D427B716E38F5A5A45B82D133869D913B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

1 malicious · 7 files
EXE4dfaee309a8515c5531855ae8184fc71QuasarRat
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key zaz5X5huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 85.huhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey Quasarhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 횶繗ꑨ ܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 횶繗ꑨ ܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::選榕曬㾋罹អ찴쵆鬐绪겋塏ᖌ簗퀷㚰篼㡞䴇᧽(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뗪潴餡街㟉䛜㆘蕽 思�좥ﴒ袣率꾀劜륯::橍딦�잂뙹䂆㚋᭣鸿ꤌ啎⎆쪢驕놆‿એ䣾()
brfalse.s IL_0040: call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
call System.Boolean 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ଲ켷桛㦐Ɣ졟઼ꕊ㺫⮉ᕠ贺﹦蜽䏢遼퓈�덹㯼()
brfalse.s IL_0040: call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
call System.Boolean 판ᅲĨ䰣ꨧ벭尞剴碆꺞䣲픵ࠊ砻悔⌘獮頳::get_Exiting()
brtrue.s IL_0040: call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
ldsfld 판ᅲĨ䰣ꨧ벭尞剴碆꺞䣲픵ࠊ砻悔⌘獮頳 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ᥭ�퇭㬔뀠뷆譗ᾮႊ⊊鿯潜୦ᅬ焵鿓ꈐ塊޺
callvirt System.Void 판ᅲĨ䰣ꨧ벭尞剴碆꺞䣲픵ࠊ砻悔⌘獮頳::籌듚ܭ�駎鎮店砵ę黫輎䬡从壎ᐫ簪嶟謁()
call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::벟愈ⳔͲ㾲읹˫焾ᢥ⍡묗�Ⴡ従砲狚䬩꟥퇗()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 횶繗ꑨ ܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 횶繗ꑨ ܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::選榕曬㾋罹អ찴쵆鬐绪겋塏ᖌ簗퀷㚰篼㡞䴇᧽(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뗪潴餡街㟉䛜㆘蕽 思�좥ﴒ袣率꾀劜륯::橍딦�잂뙹䂆㚋᭣鸿ꤌ啎⎆쪢驕놆‿એ䣾()
brfalse.s IL_0040: call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
call System.Boolean 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ଲ켷桛㦐Ɣ졟઼ꕊ㺫⮉ᕠ贺﹦蜽䏢遼퓈�덹㯼()
brfalse.s IL_0040: call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
call System.Boolean 판ᅲĨ䰣ꨧ벭尞剴碆꺞䣲픵ࠊ砻悔⌘獮頳::get_Exiting()
brtrue.s IL_0040: call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
ldsfld 판ᅲĨ䰣ꨧ벭尞剴碆꺞䣲픵ࠊ砻悔⌘獮頳 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ᥭ�퇭㬔뀠뷆譗ᾮႊ⊊鿯潜୦ᅬ焵鿓ꈐ塊޺
callvirt System.Void 판ᅲĨ䰣ꨧ벭尞剴碆꺞䣲픵ࠊ砻悔⌘獮頳::籌듚ܭ�駎鎮店砵ę黫輎䬡从壎ᐫ簪嶟謁()
call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::ꋩᕐ踛먈鼨庿㆞ઔ様︖浯단ꫤ봐࣯퀠()
call System.Void 횶繗ꑨܿ稡픕⋭餈�眘ᒏ劆낥䬋徺橧ꍅ::벟愈ⳔͲ㾲읹˫焾ᢥ⍡묗�Ⴡ従砲狚䬩꟥퇗()
ret <null>

CnC CNCmalicious
85.huhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

An error has occurred. This application may no longer respond until reloaded. Reload 🗙