Malicious
Malicious

6bab2763603ee712bf9edbc5b6872c82

PE Executable
|
MD5: 6bab2763603ee712bf9edbc5b6872c82
|
Size: 356.35 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
6bab2763603ee712bf9edbc5b6872c82
Sha1
206b251c6fac940a925cd19d4b50a760c10f8b33
Sha256
caf7254ae621cba9189e65295b25a272fe122e1ab2f3d05ec65dd0709b23d52e
Sha384
e1e04d95855b94bdc57e2596286cc67dcee915a3c9e2dc9dfb0f481ad7be90aa325c896c343a77c2a1732fd62b02c056
Sha512
f6d5e1f2d3e329f515a180beec5793c4ab14255eee0fd6f2926b4d132ac64cca81605d6e69235e7c4ee32b0124904936add5f5783086110561d63eaf1a88e94b
SSDeep
6144:1OqQ4i1FFiEKqA9NHQEAwSblE9eYM/kh4NDZNhipW:EpliF9NHCwZg/m4PNopW
TLSH
EF749D13B7A4E93BD1FE1B3AE43206145BB0D8C3B616E38B5A5856B86D133868D513F3

PeID

.NET executable
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual Studio .NET
File Structure
6bab2763603ee712bf9edbc5b6872c82
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Malware Configuration - QuasarRAT config.
Config. Field
 Value
Conf. AES-Salt

BF-EB-1E-56-FB-CD-97-3B-B2-19-02-24-30-A5-78-43-00-3D-56-44-D2-1E-62-B9-D4-F1-80-E7-E6-C3-39-41
Conf. AES-Key

VmAhFogQ6If1lB7YykJi
Version

1.3.0.0
Port

151
Host

seguritypostload.duckdns.org
ReconnectDelay

3000
Key

1WvgEMPjdwfqIMeM9MclyQ==
AuthKey

NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==
SubDirectory

SubDir
InstallName

systemi.exe
Install

0
Startup

0
Mutex

QSR_MUTEX_l1M93V
StartupKey

Quasar Client St
HideFile

1
EnableLogger

0
Tag

Proxy
LogDirectory

Logs
HideLogDirectory

1
HideLogSubdirectory

1
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.3.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

896
Main Method

System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Main IL Instruction Count

19
Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::荻̍ၖ䵷㿽뺸牂狰潆侒丟ꓚ霟ฅ຀䖞ↇ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 臬힨䷿푛挑�㻀槏맳篶䷥塒솎�꨿ྮ쁶տ�䩊::퉁펄뿐瘎媁ϓ׽�羶㐋躿ǿ�赻罚ᛓ觊勲鎁宄() brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() call System.Boolean 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�⪝ヰ퓵㔭螬퉺歁❢Ჺ撧ٜ탻呁鐕겿ḻ坔ↂ⅀() brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() call System.Boolean 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::get_Exiting() brtrue.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() ldsfld 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�ꀒ죟䢟쑜압䶮ꔣ啨⿘ꭊ흸❳⒖囻謱蕠鬽 callvirt System.Void 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::┌毯틱駷累᥿繉Ⱒᷳ�遗胷饹ӳ쳑촱() call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::膔䘗洄ぶ趵⒛谗⤐凞䊌禄໗慿狵밐䁵籾ᛞ臐() ret <null>
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.3.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0,Profile=Client
Total Strings

896
Main Method

System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Main IL Instruction Count

19
Main IL

call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::荻̍ၖ䵷㿽뺸牂狰潆侒丟ꓚ霟ฅ຀䖞ↇ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 臬힨䷿푛挑�㻀槏맳篶䷥塒솎�꨿ྮ쁶տ�䩊::퉁펄뿐瘎媁ϓ׽�羶㐋躿ǿ�赻罚ᛓ觊勲鎁宄() brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() call System.Boolean 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�⪝ヰ퓵㔭螬퉺歁❢Ჺ撧ٜ탻呁鐕겿ḻ坔ↂ⅀() brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() call System.Boolean 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::get_Exiting() brtrue.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() ldsfld 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�ꀒ죟䢟쑜압䶮ꔣ啨⿘ꭊ흸❳⒖囻謱蕠鬽 callvirt System.Void 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::┌毯틱駷累᥿繉Ⱒᷳ�遗胷饹ӳ쳑촱() call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐() call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::膔䘗洄ぶ趵⒛谗⤐凞䊌禄໗慿狵밐䁵籾ᛞ臐() ret <null>
Artefacts
Name
 Value
CnC

seguritypostload.duckdns.org
Port

151
6bab2763603ee712bf9edbc5b6872c82 (356.35 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙