Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 8 files
EXE5f8321c55d3ffcf56105303b96299ce6QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88huhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host mqdfhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host vn-huhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host consulhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88huhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host uotahuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host eroghuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88huhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au8huhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88vhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host testsehuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.ahuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.mhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.vhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.cohuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.auhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.uhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.ehuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.ahuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.ahuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.auhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host www.tehuhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88huhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host mqdfhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host vn-huhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host consulhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88huhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host uotahuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host eroghuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88huhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au8huhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host au88vhuhuhuhuhuhuhu
Conf. AES-Key 82F394huhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 4huhuhuhu
Host testsehuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Ahuhuhuhu
InstallName WagerShuhuhuhuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex 057588huhuhuhuhuhuhuhuhuhuhu
StartupKey WagerShuhuhuhuhuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Wagehuhuhuhuhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature fwNDIQhuhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
UnattendedMod 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::緀规찿謥伛㼰�⯧槥膪谔鴆꧰㳘〣濱缂ਠپ뷀(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::険㒟ᲰÃ굣꧕ജ䧨㻂꓎䟆ꥱ災豛뜆챺ౠ姺㥇(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void ℱ㕡Ꞌ砐医뗅﫸͔툂炳쉉鮚ᱜ穂Ɠ㈹럱::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.1.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
11123
Main Method
System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::緀规찿謥伛㼰�⯧槥膪谔鴆꧰㳘〣濱缂ਠپ뷀(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 鲿它檏幢첅Ƙ꺰酒�㍓큔ݧ낞ꫳ㹚帮ꆡ㬑죥::険㒟ᲰÃ굣꧕ജ䧨㻂꓎䟆ꥱ災豛뜆챺ౠ姺㥇(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void ℱ㕡Ꞌ砐医뗅﫸͔툂炳쉉鮚ᱜ穂Ɠ㈹럱::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
testsehuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
au88vhuhuhuhuhuhuhu
CnC CNCmalicious
au8huhuhuhu
CnC CNCmalicious
au88huhuhuhuhuhuhu
CnC CNCmalicious
eroghuhuhuhuhuhuhu
CnC CNCmalicious
uotahuhuhuhuhuhuhu
CnC CNCmalicious
au88huhuhuhuhuhuhu
CnC CNCmalicious
consulhuhuhuhuhuhuhu
CnC CNCmalicious
vn-huhuhuhu
CnC CNCmalicious
mqdfhuhuhuhuhuhuhu
CnC CNCmalicious
au88huhuhuhu
CnC CNCmalicious
www.tehuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
www.auhuhuhuhuhuhuhu
CnC CNCmalicious
www.ahuhuhuhuhuhuhu
CnC CNCmalicious
www.ahuhuhuhuhuhuhu
CnC CNCmalicious
www.ehuhuhuhuhuhuhu
CnC CNCmalicious
www.uhuhuhuhuhuhuhu
CnC CNCmalicious
www.auhuhuhuhuhuhuhu
CnC CNCmalicious
www.cohuhuhuhuhuhuhu
CnC CNCmalicious
www.vhuhuhuhuhuhuhu
CnC CNCmalicious
www.mhuhuhuhuhuhuhu
CnC CNCmalicious
www.ahuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙