Malicious
Malicious

PE Executable
MD5: 876ff2dde9e749433cbc146494e3661c
Size: 532.49 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
532.49 KB · 532,492 B
Hashes
MD5 876ff2dde9e749433cbc146494e3661c Sha1 043d00927b90cdeb28e2363e232a86d037c99a3b Sha256 7f96177416122537d0ca9f70b7ae0d34c8f72d32c7b1382d32c76fb8a5c6ad80 Sha384 4d0fd59432cb5401b8476e87244baf28950b068c3c348f3d90b0b21f59ef50aaf43773556b5030c618ee63837f937b33 Sha512 5008f609b57a1ce3f77c96f8e09039390876fc2508fe14a8f79f00570806444d6f9b13468b5310750bad308277d52a39234e0eca68f005ac007eb40205a949c2 SSDeep 6144:0TEgdc0YhX7IxUpGREWduIEdP/9Ko0tQpocElab8F9z+IgwpngcTR3y:0TEgdfYixUJZ0PVdlhpngcdy TLSH F1B46C4063F8852BE1AE577AE871042597F4F407B2ABEF4F4A40A1F93D6670AAD40773
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
2 malicious · 4 files
EXE876ff2dde9e749433cbc146494e3661cQuasarRat
EXE[Rebuild from dump]_80a80d11.exeQuasarRat
BIN.Net Resources
BINQuasar.Client.Properties.Resources.resources
LISTILRepack.List
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key FB2846huhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port stub.huhuhuhuhuhuhu
Host stub.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex 3c5730huhuhuhuhuhuhuhuhuhuhu
StartupKey Cliehuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature STfAr9huhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
1552
Main Method
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::鳙哶杓㥟�莋뺻ㅦퟎ㐐’㋓᭘뷌⎍⍞Ồ⠞(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::튇瓟彲胊췘樑帀盚⺶ࣴ闾�㻤䤤ꀛᒀ౳ꂭᰝ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Ꮜ㻺锢儷Ɯ䱱�Ồེﻉ췙榬縪楗簭삃竏谌::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
1552
Main Method
System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::鳙哶杓㥟�莋뺻ㅦퟎ㐐’㋓᭘뷌⎍⍞Ồ⠞(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 푨砣隅�겄ꥅ䄘䅌ἵ泼驗셆쬙׶嵰ᠮ瓪絆﹛::튇瓟彲胊췘樑帀盚⺶ࣴ闾�㻤䤤ꀛᒀ౳ꂭᰝ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Ꮜ㻺锢儷Ɯ䱱�Ồེﻉ췙榬縪楗簭삃竏谌::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
stub.huhuhuhuhuhuhu
Port PORTmalicious
stub.huhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2 malicious · 4 files
EXE876ff2dde9e749433cbc146494e3661cQuasarRat
EXE[Rebuild from dump]_80a80d11.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key FB2846huhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port stub.huhuhuhuhuhuhu
Host stub.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex 3c5730huhuhuhuhuhuhuhuhuhuhu
StartupKey Cliehuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
ServerSignature STfAr9huhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
stub.huhuhuhuhuhuhu
876ff2dde9e749433cbc146494e3661c
Port PORTmalicious
stub.huhuhuhuhuhuhu
876ff2dde9e749433cbc146494e3661c
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
876ff2dde9e749433cbc146494e3661c
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙