Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXE5e6a37ab09494031ecd0b8cd04ca886eQuasarRat
EXE[Rebuild from dump]_6aca710b.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key ypZCvEhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port win23huhuhuhuhuhuhu
Host win23huhuhuhuhuhuhu
Conf. AES-Key ypZCvEhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 5huhuhuhu
Host windowhuhuhuhuhuhuhu
ReconnectDelay 2huhuhuhu
Key oXCnUihuhuhuhuhuhuhu
AuthKey h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex RSQ_XEhuhuhuhuhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Thuhuhuhu
LogDirectory Lohuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::⓵먙ೈ膛鼆釳㴸惇㰸돿⓽⥴杕(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 陲䗗ຖ✧蘬擮牸웮첇썃㰖Ꮼ맦꥘杆瘪᫆큭草ถ::ꚉᚦ쩼ꄜ⻼ດඑ᳙䓒＿齓䱱ᩗ瀅垁ꏊ叐殁()
brfalse.s IL_0040: call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
call System.Boolean 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::윌駇犾휮墲蚸㋨贞يཷ氂處ጆ䰷떒⺚ỿ慭懚()
brfalse.s IL_0040: call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
call System.Boolean 砖սꈪᲙﱄ酪퀹䲁罣곈棁�蹅ꂛ�鉍೟涮왴�::get_Exiting()
brtrue.s IL_0040: call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
ldsfld 砖սꈪᲙﱄ酪퀹䲁罣곈棁�蹅ꂛ�鉍೟涮왴� 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﶋ䟴輬⁎ឯꪽ囆ࢿꍼ技╮ꪰ樎ሻ痦后鯌
callvirt System.Void 砖սꈪᲙﱄ酪퀹䲁罣곈棁�蹅ꂛ�鉍೟涮왴�::邨쫉啣瞴䒿㨍烒⣡샆ծ孢䕆担ˠ಄谗햑鱭()
call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::紶䯯ᒮᔏ騱�旌⻩⟱洜狱ᬞ�첑䜒()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::⓵먙ೈ膛鼆釳㴸惇㰸돿⓽⥴杕(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 陲䗗ຖ✧蘬擮牸웮첇썃㰖Ꮼ맦꥘杆瘪᫆큭草ถ::ꚉᚦ쩼ꄜ⻼ດඑ᳙䓒＿齓䱱ᩗ瀅垁ꏊ叐殁()
brfalse.s IL_0040: call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
call System.Boolean 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::윌駇犾휮墲蚸㋨贞يཷ氂處ጆ䰷떒⺚ỿ慭懚()
brfalse.s IL_0040: call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
call System.Boolean 砖սꈪᲙﱄ酪퀹䲁罣곈棁�蹅ꂛ�鉍೟涮왴�::get_Exiting()
brtrue.s IL_0040: call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
ldsfld 砖սꈪᲙﱄ酪퀹䲁罣곈棁�蹅ꂛ�鉍೟涮왴� 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﶋ䟴輬⁎ឯꪽ囆ࢿꍼ技╮ꪰ樎ሻ痦后鯌
callvirt System.Void 砖սꈪᲙﱄ酪퀹䲁罣곈棁�蹅ꂛ�鉍೟涮왴�::邨쫉啣瞴䒿㨍烒⣡샆ծ孢䕆担ˠ಄谗햑鱭()
call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::ﳍ통注㺠ូ篤鲽㸇埑⹮ီ콬풋橈ᤡ勚䄜ࡀ()
call System.Void 帳셇咋玮갩즇馚撡팁馿묒μﰻ�ë뱮ᷗ::紶䯯ᒮᔏ騱�旌⻩⟱洜狱ᬞ�첑䜒()
ret <null>
CnC CNCmalicious
windowhuhuhuhuhuhuhu
Port PORTmalicious
5huhuhuhu
CnC CNCmalicious
win23huhuhuhuhuhuhu
Port PORTmalicious
win23huhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙