Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE6bab2763603ee712bf9edbc5b6872c82QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key VmAhFohuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host segurihuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName syshuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 0huhuhuhu
Tag Phuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::荻̍ၖ䵷㿽뺸牂狰潆侒丟ꓚ霟ฅ຀䖞ↇ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 臬힨䷿푛挑�㻀槏맳篶䷥塒솎�꨿ྮ쁶տ�䩊::퉁펄뿐瘎媁ϓ׽�羶㐋躿ǿ�赻罚ᛓ觊勲鎁宄()
brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
call System.Boolean 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�⪝ヰ퓵㔭螬퉺歁❢Ჺ撧ٜ탻呁鐕겿ḻ坔ↂ⅀()
brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
call System.Boolean 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::get_Exiting()
brtrue.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
ldsfld 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�ꀒ죟䢟쑜압䶮ꔣ啨⿘ꭊ흸❳⒖囻謱蕠鬽
callvirt System.Void 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::┌毯틱駷累᥿繉Ⱒᷳ�遗胷饹ӳ쳑촱()
call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::膔䘗洄ぶ趵⒛谗⤐凞䊌禄໗慿狵밐䁵籾ᛞ臐()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::荻̍ၖ䵷㿽뺸牂狰潆侒丟ꓚ霟ฅ຀䖞ↇ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 臬힨䷿푛挑�㻀槏맳篶䷥塒솎�꨿ྮ쁶տ�䩊::퉁펄뿐瘎媁ϓ׽�羶㐋躿ǿ�赻罚ᛓ觊勲鎁宄()
brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
call System.Boolean 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�⪝ヰ퓵㔭螬퉺歁❢Ჺ撧ٜ탻呁鐕겿ḻ坔ↂ⅀()
brfalse.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
call System.Boolean 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::get_Exiting()
brtrue.s IL_0040: call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
ldsfld 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::�ꀒ죟䢟쑜압䶮ꔣ啨⿘ꭊ흸❳⒖囻謱蕠鬽
callvirt System.Void 阦鿛办Ẋ缜ﮙ메�㵍ꨍ迈៫蓸敄偣앸﬒鉯::┌毯틱駷累᥿繉Ⱒᷳ�遗胷饹ӳ쳑촱()
call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::恢�褒喞䙒筂ﶎ.﹎릕揦ᜒѺ჻ᇎ뭮鉨晳⚽謐()
call System.Void 厉偱峵엀克᝝ｰ㝗ᆢ臟蓬꓈偶䫕띕䦳Җ餙::膔䘗洄ぶ趵⒛谗⤐凞䊌禄໗慿狵밐䁵籾ᛞ臐()
ret <null>
CnC CNCmalicious
segurihuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙