Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE5cb2f4367bb9d489814b3723aa02389bQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key lF5PxYhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 3huhuhuhu
Host 3huhuhuhu
Conf. AES-Key lF5PxYhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host windowhuhuhuhuhuhuhu
ReconnectDelay 2huhuhuhu
Key oXCnUihuhuhuhuhuhuhu
AuthKey h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory uhuhuhuhu
InstallName jsthuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Windohuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag 20huhuhuhu
LogDirectory ohuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::⭢큆뿔퐊⧱襀⠑됹藸嶳隆烎᡻ἆꖹ怈夙(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean �퉃ሗꃚ헦㩉俼ീȟ风炄ꯣ冑ꤗ㼥::느塘脨᝕㶥㳸䜣참｛룺췚꼐Ꮒℎ쓩蓶瓷獌()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::颮풨層赏貽⚢򷅔겦㏕䟷濱㉧뤫ᠱᬞ귗()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::get_Exiting()
brtrue.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
ldsfld 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥 ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::㒾晑穟ᰢ臥淎취㆐邬੕祜⭱ቌꢒ驳畲⩏㌋�蕶
callvirt System.Void 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::逿⡝搒ম꾿皎츳᭼꘮蚄湿奄靪᳸䩇�|⤹䇾()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::箵྄�糄¤殜ﭟ췤帬䧆᲏⓶칫ꞛ굦鋢릓랁()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::⭢큆뿔퐊⧱襀⠑됹藸嶳隆烎᡻ἆꖹ怈夙(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean �퉃ሗꃚ헦㩉俼ീȟ风炄ꯣ冑ꤗ㼥::느塘脨᝕㶥㳸䜣참｛룺췚꼐Ꮒℎ쓩蓶瓷獌()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::颮풨層赏貽⚢򷅔겦㏕䟷濱㉧뤫ᠱᬞ귗()
brfalse.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Boolean 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::get_Exiting()
brtrue.s IL_0040: call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
ldsfld 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥 ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::㒾晑穟ᰢ臥淎취㆐邬੕祜⭱ቌꢒ驳畲⩏㌋�蕶
callvirt System.Void 祙㺌ᣕ羰ᇋ몞ͩ떂䯺煺ᣪᑩᶤ彫ꩌ嵒檥::逿⡝搒ম꾿皎츳᭼꘮蚄湿奄靪᳸䩇�|⤹䇾()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::鵾㜾듅漉傟㘤㶡턑䚍䭄預回眠⩇쑱㼬ʕ풬멡꣼()
call System.Void ៞亮㢽爊悩ꩣঘӡ墧楲嫏䢛͆쳽黤곊급뎾::箵྄�糄¤殜ﭟ췤帬䧆᲏⓶칫ꞛ굦鋢릓랁()
ret <null>
CnC CNCmalicious
windowhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
3huhuhuhu
Port PORTmalicious
3huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙