Malicious
Malicious

PE Executable
MD5: 855c99ea0d3f93a04ca2cba641728c2d
Size: 514.05 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
514.05 KB · 514,048 B
First seen
2025-11-23 00:02 · 11 months ago
Last seen
2025-11-23 00:02 · 11 months ago
Last analysis
2025-11-23 00:04 · 11 months ago
Hashes
MD5 855c99ea0d3f93a04ca2cba641728c2d Sha1 b885929e1097122465b1aaa104586cfccdb7d6fc Sha256 2ac4fb81983288f2d48708e0c08c50a1353f82525184e4f533c9f303d644cada Sha384 499d51b213a45fc73bbbd05cf73b2d6763788329071de5af1de9596225c334ce0858ff57848746fdf4642bd8479aa364 Sha512 335aa40c5058b3904b866359cf51dcd6e9e632ddcca52b15ad0eb435931bed82571050122f7e3a1ab47a1634fba75f3684372846698f36940814e80c5926095d SSDeep 6144:xTEgdc0YhX7IxUpGREWduIEdP/9Ko0tQpocElab8F9z+IgwpngcTR3y:xTEgdfYixUJZ0PVdlhpngcdy TLSH F8B46C4063F8852BE1AE577AE871042597F4F407B2ABEF4F4A40A1F93D6670AAD40773
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 5 files
EXE855c99ea0d3f93a04ca2cba641728c2dQuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINQuasar.Client.Properties.Resources.resources
LISTILRepack.List
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key FB2846huhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port stub.huhuhuhuhuhuhu
Host stub.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex 3c5730huhuhuhuhuhuhuhuhuhuhu
StartupKey Cliehuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature STfAr9huhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
1552
Main Method
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::鳙哶杓㥟�莋뺻ㅦퟎ㐐’㋓᭘뷌⎍⍞Ồ⠞(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::튇瓟彲胊췘樑帀盚⺶ࣴ闾�㻤䤤ꀛᒀ౳ꂭᰝ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Ꮜ㻺锢儷Ɯ䱱�Ồེﻉ췙榬縪楗簭삃竏谌::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
1552
Main Method
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::鳙哶杓㥟�莋뺻ㅦퟎ㐐’㋓᭘뷌⎍⍞Ồ⠞(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::튇瓟彲胊췘樑帀盚⺶ࣴ闾�㻤䤤ꀛᒀ౳ꂭᰝ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Ꮜ㻺锢儷Ɯ䱱�Ồེﻉ췙榬縪楗簭삃竏谌::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
stub.huhuhuhuhuhuhu
Port PORTmalicious
stub.huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 5 files
EXE855c99ea0d3f93a04ca2cba641728c2dQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key FB2846huhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port stub.huhuhuhuhuhuhu
Host stub.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex 3c5730huhuhuhuhuhuhuhuhuhuhu
StartupKey Cliehuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature STfAr9huhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
stub.huhuhuhuhuhuhu
855c99ea0d3f93a04ca2cba641728c2d
Port PORTmalicious
stub.huhuhuhuhuhuhu
855c99ea0d3f93a04ca2cba641728c2d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙