Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE7fbd491b8757aafb7f8a95ae14abf17cQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key BpQt1uhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port mimalhuhuhuhuhuhuhu
Host mimalhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::뫾÷늟㜧抺煺벸蔒䖎ƹ羪ᗿ⨵걀㷯ᱳﵗ⤃᷽(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 悊琹툶ꭳ抿ꖈ쒕쁇胒ﱩ䝣乐霌잃⚦쒐劾믐᰻::⹴Č鵛㨡贈䙼䩚ℙ萰䮥�ﺺ᧼ᡖ고ꦈ溤㳦()
brfalse.s IL_0040: call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
call System.Boolean е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::䌓ꩊ笠䟸닕�翮ᤉቈ⹧�抄ᠻ攅㋋�얓㖒ꔨ()
brfalse.s IL_0040: call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
call System.Boolean 덝솗硦⸅쭫嬒鍭鏥躂鋩艑�胤ꏊ�ﶃⱢ뼝::get_Exiting()
brtrue.s IL_0040: call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
ldsfld 덝솗硦⸅쭫嬒鍭鏥躂鋩艑�胤ꏊ�ﶃⱢ뼝 е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::쳾䏟ꕀ惸⎰얀흒ᙖ輹諽寚巋ꌂ嵃椨跃藒
callvirt System.Void 덝솗硦⸅쭫嬒鍭鏥躂鋩艑�胤ꏊ�ﶃⱢ뼝::僷ಇኃ琚仼鬤얋躋ꟴ䪾뜦蘫꺴괙敒⸙()
call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::�䅠痁磦䓯뵳�展椎騦暖介㱮혇遇�䮐룚()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::뫾÷늟㜧抺煺벸蔒䖎ƹ羪ᗿ⨵걀㷯ᱳﵗ⤃᷽(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 悊琹툶ꭳ抿ꖈ쒕쁇胒ﱩ䝣乐霌잃⚦쒐劾믐᰻::⹴Č鵛㨡贈䙼䩚ℙ萰䮥�ﺺ᧼ᡖ고ꦈ溤㳦()
brfalse.s IL_0040: call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
call System.Boolean е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::䌓ꩊ笠䟸닕�翮ᤉቈ⹧�抄ᠻ攅㋋�얓㖒ꔨ()
brfalse.s IL_0040: call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
call System.Boolean 덝솗硦⸅쭫嬒鍭鏥躂鋩艑�胤ꏊ�ﶃⱢ뼝::get_Exiting()
brtrue.s IL_0040: call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
ldsfld 덝솗硦⸅쭫嬒鍭鏥躂鋩艑�胤ꏊ�ﶃⱢ뼝 е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::쳾䏟ꕀ惸⎰얀흒ᙖ輹諽寚巋ꌂ嵃椨跃藒
callvirt System.Void 덝솗硦⸅쭫嬒鍭鏥躂鋩艑�胤ꏊ�ﶃⱢ뼝::僷ಇኃ琚仼鬤얋躋ꟴ䪾뜦蘫꺴괙敒⸙()
call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::퉆ꆿⰘ䖫⏇撳燅ᕒ玗ⶖ㨮㝣Ḛ淣収�垫ꆥ()
call System.Void е鍵뫽飽䋑序퍓ꁩⱴꬎ罩�䄚ꅈ඲ꗰ蛗鮬::�䅠痁磦䓯뵳�展椎騦暖介㱮혇遇�䮐룚()
ret <null>
CnC CNCmalicious
mimalhuhuhuhuhuhuhu
Port PORTmalicious
mimalhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙