Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 8 files
EXE4e0ffe2e522134b84adf341b9d569908QuasarRat
Structure
BINOverlay_e35661c8.bin
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key ZtohN2huhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 1huhuhuhu
Host 1huhuhuhu
Conf. AES-Key ZtohN2huhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host 127huhuhuhu
Conf. AES-Key ZtohN2huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host 127huhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory NVhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey NVIDIhuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Tehuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
Overlay extracted: Overlay_e35661c8.bin (11688 bytes)
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::ᒲ锦潸맷�駃殊袭詪摧呧汢�眄谼䇕镬⾳氙(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⱌ雇㺭克喾盎줁罁襊䓤㍶猏푅仚趘⺚⻠薎눩::捙ᾒŋ䯟ꋳ쫋퍽ዧ�ख़ꗠ諣֫ዽ⿠阫葐()
brfalse.s IL_0040: call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
call System.Boolean ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::頥௜叝객㇦㮠㛽돉꿓铐셍毝捯琐딘తđ㑈�()
brfalse.s IL_0040: call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
call System.Boolean 鱊ւ偉酈⯹ʤꧤᤛ缾骻፱ꔣᐷ⯽쾬::get_Exiting()
brtrue.s IL_0040: call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
ldsfld 鱊ւ偉酈⯹ʤꧤᤛ缾骻፱ꔣᐷ⯽쾬 ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::鑜ȧꐙ鵵Ɛ၈勩嬱䅻揅鐰䅟勏帎࿘猱㏓랉嫡׼
callvirt System.Void 鱊ւ偉酈⯹ʤꧤᤛ缾骻፱ꔣᐷ⯽쾬::銳�搆⢒侍㉤옋䂼ꨅ챭䭿䜉利除쭁ꀉ躷擞()
call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::㪩缝찪濈莈缅룛裌⬔髓ꎐ碇ṅ㙍흰핀ﾺ䦟()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::ᒲ锦潸맷�駃殊袭詪摧呧汢�眄谼䇕镬⾳氙(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⱌ雇㺭克喾盎줁罁襊䓤㍶猏푅仚趘⺚⻠薎눩::捙ᾒŋ䯟ꋳ쫋퍽ዧ�ख़ꗠ諣֫ዽ⿠阫葐()
brfalse.s IL_0040: call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
call System.Boolean ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::頥௜叝객㇦㮠㛽돉꿓铐셍毝捯琐딘తđ㑈�()
brfalse.s IL_0040: call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
call System.Boolean 鱊ւ偉酈⯹ʤꧤᤛ缾骻፱ꔣᐷ⯽쾬::get_Exiting()
brtrue.s IL_0040: call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
ldsfld 鱊ւ偉酈⯹ʤꧤᤛ缾骻፱ꔣᐷ⯽쾬 ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::鑜ȧꐙ鵵Ɛ၈勩嬱䅻揅鐰䅟勏帎࿘猱㏓랉嫡׼
callvirt System.Void 鱊ւ偉酈⯹ʤꧤᤛ缾骻፱ꔣᐷ⯽쾬::銳�搆⢒侍㉤옋䂼ꨅ챭䭿䜉利除쭁ꀉ躷擞()
call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::⫞莿甸Ḵ臐�␴ඳᤠⳞ⃆⿊術≫흆譒誗䨩쑰擄()
call System.Void ᭊ覣吕䀘䝠轏ꫧ輖쭍땘⽩␂춵񓪵挴ڄ::㪩缝찪濈莈缅룛裌⬔髓ꎐ碇ṅ㙍흰핀ﾺ䦟()
ret <null>
CnC CNCmalicious
127huhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
127huhuhuhu
CnC CNCmalicious
1huhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙