Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 22 files
EXE80006c93872291d6bfdc4386a33fd244QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key AGcOIshuhuhuhuhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port up.drhuhuhuhuhuhuhu
Host up.drhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key Suhuhuhuhu
AuthKey msdhuhuhuhu
SubDirectory 1huhuhuhu
InstallName 1huhuhuhu
Install QSR_Mhuhuhuhuhuhuhu
Startup mhuhuhuhu
Mutex 0huhuhuhu
StartupKey 1huhuhuhu
HideFile Ohuhuhuhu
EnableLogger Lhuhuhuhu
Tag Sta2achuhuhuhuhuhuhuhuhuhuhu
LogDirectory MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.all.exe
Full Name
Client.all.exe
EntryPoint
System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::Main(System.String[])
Scope Name
Client.all.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client.all
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
1644
Main Method
System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::蟼뎓샷暬葥叓ѧ枼쓣녇皍隁渻ɺ䨯⡋悚焕ꈨ譵(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ㅾ㤒ｨﵿ郰Ċ₠쭪Ĥ⣘㝾�࿗잂衈꬧懙扩㫑::䊢觙꧚紴奤濲졼ᬓŹ콮㰄텔혧嗼ஆ捝쥸쌕쪆()
brfalse IL_0049: call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
call System.Boolean 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::ⷑ齽⟽욄澪䁦鐢脤廟ﾾ熞煮믦�朋ﳔ溑కჁ()
brfalse IL_0049: call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
call System.Boolean ୿ڮ彩왎㒡ᚐ掏ল⽰�믝뱻헚砾ε獳::get_Exiting()
brtrue IL_0049: call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
ldsfld ୿ڮ彩왎㒡ᚐ掏ল⽰�믝뱻헚砾ε獳 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::쑥䦱Ϙ륒㜶ﱪ惃孇ষꉝᇩ枅訮䌼씀룴
callvirt System.Void ୿ڮ彩왎㒡ᚐ掏ল⽰�믝뱻헚砾ε獳::簏ꍡ쎖턫⚝ꛋ칁芻䶏ɥ뷋뤟齃쬀袉䑄ᗊ()
call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::끞룶웫࡚ꬵ飍섢鳶턙骭藰띻뛫▂톫胼()
ret <null>
Module Name
Client.all.exe
Full Name
Client.all.exe
EntryPoint
System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::Main(System.String[])
Scope Name
Client.all.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client.all
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
1644
Main Method
System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::蟼뎓샷暬葥叓ѧ枼쓣녇皍隁渻ɺ䨯⡋悚焕ꈨ譵(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ㅾ㤒ｨﵿ郰Ċ₠쭪Ĥ⣘㝾�࿗잂衈꬧懙扩㫑::䊢觙꧚紴奤濲졼ᬓŹ콮㰄텔혧嗼ஆ捝쥸쌕쪆()
brfalse IL_0049: call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
call System.Boolean 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::ⷑ齽⟽욄澪䁦鐢脤廟ﾾ熞煮믦�朋ﳔ溑కჁ()
brfalse IL_0049: call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
call System.Boolean ୿ڮ彩왎㒡ᚐ掏ল⽰�믝뱻헚砾ε獳::get_Exiting()
brtrue IL_0049: call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
ldsfld ୿ڮ彩왎㒡ᚐ掏ল⽰�믝뱻헚砾ε獳 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::쑥䦱Ϙ륒㜶ﱪ惃孇ষꉝᇩ枅訮䌼씀룴
callvirt System.Void ୿ڮ彩왎㒡ᚐ掏ল⽰�믝뱻헚砾ε獳::簏ꍡ쎖턫⚝ꛋ칁芻䶏ɥ뷋뤟齃쬀袉䑄ᗊ()
call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::㠬筼蓂㦹᫙ᱷ�᎙㏗莢䫅࠸곂⑜ᾟ鳻ယ荑Ⲋ()
call System.Void 숔摕夫ᇠ낽᯶뙎쒥⮿쀥␀컼잾漛皰ᄆ쨫::끞룶웫࡚ꬵ飍섢鳶턙骭藰띻뛫▂톫胼()
ret <null>
CnC CNCmalicious
up.drhuhuhuhuhuhuhu
Port PORTmalicious
up.drhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙