Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Symbol obfuscation
High
1 malicious · 27 files
EXE6332505db61f12a4b71f5beed8ff2898QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version aFQJmyhuhuhuhuhuhuhuhuhuhuhu
Port AqXEjZhuhuhuhuhuhuhuhuhuhuhu
Host AqXEjZhuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 4n0geAhuhuhuhuhuhuhuhuhuhuhu
SubDirectory PIej5+huhuhuhuhuhuhuhuhuhuhu
InstallName 1huhuhuhu
Install 0huhuhuhu
Startup uB3gBghuhuhuhuhuhuhuhuhuhuhu
Mutex xP8BVYhuhuhuhuhuhuhuhuhuhuhu
StartupKey 1huhuhuhu
HideFile 0huhuhuhu
EnableLogger 750FE3huhuhuhuhuhuhuhuhuhuhu
EncryptionKey Bt0nv+huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
613
Main Method
System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::Main()
Main IL Instruction Count
21
Main IL 
call System.Boolean 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::ꈍ蛺鐧濶ꊧ돧躲퇭刺ᠠ療�᳞䔿೰彈䨪夑()
pop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::ᒐҳ篅橽䡥⨙퟇쓋게뤰燰꺒왨寅耊䚹祈(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::�ꎈ羈섀擓Ⅱ꠭꜖ḡꌆ칪㚕ේ፽녽훈쒲轁⡻(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 鄡쭑⟣雉뿓触痁荌蔆蝘鉌嚐쌝鸲⇉༜r૥Ỻ::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
613
Main Method
System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::Main()
Main IL Instruction Count
21
Main IL 
call System.Boolean 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::ꈍ蛺鐧濶ꊧ돧躲퇭刺ᠠ療�᳞䔿೰彈䨪夑()
pop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::ᒐҳ篅橽䡥⨙퟇쓋게뤰燰꺒왨寅耊䚹祈(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 퐟欘㴾쀚媔艳想髜๦꿪�듃뾓헅蘆ᇺ礼ù::�ꎈ羈섀擓Ⅱ꠭꜖ḡꌆ칪㚕ේ፽녽훈쒲轁⡻(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 鄡쭑⟣雉뿓触痁荌蔆蝘鉌嚐쌝鸲⇉༜r૥Ỻ::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
AqXEjZhuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
AqXEjZhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙