Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE5077f10dcc14b8b80cb2661042968cd4QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key Akroq7huhuhuhuhuhuhu
Version 1.huhuhuhu
Port aafrahuhuhuhuhuhuhu
Host aafrahuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag ahuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::핸㩖ᡁ悒麱∘㜼젰톞�졬넡뇲䀮䠂䪁ﻄ斈(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 풃쒐琢绘雮⿩苁嗟擔Ԥᔠ䶶뉿哜ᲆ࡭废::ꇇ鱟軡⡧襢皊⊰錀Ჿ悆栞�貿⿪爜ȟ뷼()
brfalse.s IL_0040: call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
call System.Boolean 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::礬烮컅竆퉙삪ⵔꤌ縙朇翑⡛ꂡ᳣메鏄렛()
brfalse.s IL_0040: call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
call System.Boolean 欄庡遲湒繺打Ǹ࡫֥埛誱嶱䚲㔷뾰�Б▞㣹::get_Exiting()
brtrue.s IL_0040: call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
ldsfld 欄庡遲湒繺打Ǹ࡫֥埛誱嶱䚲㔷뾰�Б▞㣹 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::躂俬㥝䔮式擁�据↖産憠戫㐕딐㳟녴坌
callvirt System.Void 欄庡遲湒繺打Ǹ࡫֥埛誱嶱䚲㔷뾰�Б▞㣹::匱刚䉷䍩疇霐ꁾ煮﹵Ώ揽싽榠푶翂뽑鋰잠()
call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::ꣴᢸ乲ꛘ蟌氵ꦣ檔阧庆䇯뭵哖跾⮽Ꮷ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::핸㩖ᡁ悒麱∘㜼젰톞�졬넡뇲䀮䠂䪁ﻄ斈(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 풃쒐琢绘雮⿩苁嗟擔Ԥᔠ䶶뉿哜ᲆ࡭废::ꇇ鱟軡⡧襢皊⊰錀Ჿ悆栞�貿⿪爜ȟ뷼()
brfalse.s IL_0040: call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
call System.Boolean 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::礬烮컅竆퉙삪ⵔꤌ縙朇翑⡛ꂡ᳣메鏄렛()
brfalse.s IL_0040: call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
call System.Boolean 欄庡遲湒繺打Ǹ࡫֥埛誱嶱䚲㔷뾰�Б▞㣹::get_Exiting()
brtrue.s IL_0040: call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
ldsfld 欄庡遲湒繺打Ǹ࡫֥埛誱嶱䚲㔷뾰�Б▞㣹 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::躂俬㥝䔮式擁�据↖産憠戫㐕딐㳟녴坌
callvirt System.Void 欄庡遲湒繺打Ǹ࡫֥埛誱嶱䚲㔷뾰�Б▞㣹::匱刚䉷䍩疇霐ꁾ煮﹵Ώ揽싽榠푶翂뽑鋰잠()
call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::볠⥇搫ㄸ氒꘤晇⛹ꟛ亮ﾞﳪᩮꖑ隃㫖頤()
call System.Void 厴㣹돞楢懯揄䰤眘璬ᜩ밒⃠ɯ㙛ⲓ殳竓::ꣴᢸ乲ꛘ蟌氵ꦣ檔阧庆䇯뭵哖跾⮽Ꮷ()
ret <null>
CnC CNCmalicious
aafrahuhuhuhuhuhuhu
Port PORTmalicious
aafrahuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙