Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE53a3b69d8cbefe8a653057cc7118f30bQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key XM7h80huhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port gahuhuhuhu
Host gahuhuhuhu
Conf. AES-Key XM7h80huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 7huhuhuhu
Host titinehuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory michuhuhuhu
InstallName Updathuhuhuhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey servhuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag vhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::�鷁뱁튄�鿢쫮렒㯽ퟄ要숍�ᙙ�룴(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⨝뷂䦮넧୷谑㪪졵픫㒥�⌸ฏ钸吠旻龻侨趡::㥟樮ြ姷屮㇌悬㺶㪑�끪묿嶄Ⱄꄆ톁ᑮ밃()
brfalse.s IL_0040: call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
call System.Boolean 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::伬싵롖騣❅솳씄䮞俶䲯ȋᢊ䕟濁뀒囹()
brfalse.s IL_0040: call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
call System.Boolean 䗪⼭櫀ኊꂻ⯌脻씧㉦乵Ⴉ颅闧擰�뉧箨壡�::get_Exiting()
brtrue.s IL_0040: call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
ldsfld 䗪⼭櫀ኊꂻ⯌脻씧㉦乵Ⴉ颅闧擰�뉧箨壡� 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::出屢ᛁ䦦澘쯱�嬵냛௓岓ꑶነ㹮㎿�湧
callvirt System.Void 䗪⼭櫀ኊꂻ⯌脻씧㉦乵Ⴉ颅闧擰�뉧箨壡�::⫋儳䭒⬃ﲓ孾ꗏ낸㬖醤ӆ⟶拓饑챢ᴯⰃ距()
call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::ߨ簯ৠॅ䃫밤嶂춤⟊￑녃䝤悠檝쯵ೋ刴赑ㄐ麰()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::�鷁뱁튄�鿢쫮렒㯽ퟄ要숍�ᙙ�룴(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⨝뷂䦮넧୷谑㪪졵픫㒥�⌸ฏ钸吠旻龻侨趡::㥟樮ြ姷屮㇌悬㺶㪑�끪묿嶄Ⱄꄆ톁ᑮ밃()
brfalse.s IL_0040: call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
call System.Boolean 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::伬싵롖騣❅솳씄䮞俶䲯ȋᢊ䕟濁뀒囹()
brfalse.s IL_0040: call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
call System.Boolean 䗪⼭櫀ኊꂻ⯌脻씧㉦乵Ⴉ颅闧擰�뉧箨壡�::get_Exiting()
brtrue.s IL_0040: call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
ldsfld 䗪⼭櫀ኊꂻ⯌脻씧㉦乵Ⴉ颅闧擰�뉧箨壡� 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::出屢ᛁ䦦澘쯱�嬵냛௓岓ꑶነ㹮㎿�湧
callvirt System.Void 䗪⼭櫀ኊꂻ⯌脻씧㉦乵Ⴉ颅闧擰�뉧箨壡�::⫋儳䭒⬃ﲓ孾ꗏ낸㬖醤ӆ⟶拓饑챢ᴯⰃ距()
call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::錈云烩㗘쓓粜₤젗뮢�蝘�ᾟ畟熐웅()
call System.Void 躗䇰ܞ☴ζ╧ׂ碾ఽ语㶈�㈕黙Ꞔ໌쑚㜇::ߨ簯ৠॅ䃫밤嶂춤⟊￑녃䝤悠檝쯵ೋ刴赑ㄐ麰()
ret <null>
CnC CNCmalicious
titinehuhuhuhuhuhuhu
Port PORTmalicious
7huhuhuhu
CnC CNCmalicious
gahuhuhuhu
Port PORTmalicious
gahuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙