Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2 malicious · 2 files
EXE8b5dfde6d441112266a058c50639d678QuasarRat
EXE[Rebuild from dump]_99e2eaa8.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key uqdAsthuhuhuhuhuhuhu
Version 1.huhuhuhu
Port ethh.huhuhuhuhuhuhu
Host ethh.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key WxfziAhuhuhuhuhuhuhu
AuthKey TUHMbMhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Blushuhuhuhuhuhuhu
InstallName Blusthuhuhuhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Blushuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Ehuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::좒䒃뿏㣱纨ᢕ鰂쥹⢻䇸霥缼岢䣣ᗬ撞꟰ꖋ뤡(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 澔䚓ꯙš୕ᅑῄஔ㍋톢ꃇ㽙撜鹾堒ᇡ৊::鑌纶ꞑ˂웥≒뒄嗽㺣ୗ쮔ό㏸캸ゖ駘䄻()
brfalse.s IL_0040: call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
call System.Boolean 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::蹉搙᪓敌봃竺≽夀孅啚贗들ꭩ~揮楸()
brfalse.s IL_0040: call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
call System.Boolean ꥞햜᧩檌茽ꕸꯉ껄쯕օꧽ쇗鬉�퟼萗囊�䤟::get_Exiting()
brtrue.s IL_0040: call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
ldsfld ꥞햜᧩檌茽ꕸꯉ껄쯕օꧽ쇗鬉�퟼萗囊�䤟 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::㞚墟훅ꨖ쐩鼓㷷㡀踗䨄再꥕男血ꡇ竌
callvirt System.Void ꥞햜᧩檌茽ꕸꯉ껄쯕օꧽ쇗鬉�퟼萗囊�䤟::궄눽⽢푚ᡮ䕅淂餿醛쒡肔颭鋑腒焔ß登뇟דּ()
call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::冇銢㷵疻믅㼗䷠魹☦荏폒顥坊㧔ᶏ泽敨()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::좒䒃뿏㣱纨ᢕ鰂쥹⢻䇸霥缼岢䣣ᗬ撞꟰ꖋ뤡(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 澔䚓ꯙš୕ᅑῄஔ㍋톢ꃇ㽙撜鹾堒ᇡ৊::鑌纶ꞑ˂웥≒뒄嗽㺣ୗ쮔ό㏸캸ゖ駘䄻()
brfalse.s IL_0040: call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
call System.Boolean 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::蹉搙᪓敌봃竺≽夀孅啚贗들ꭩ~揮楸()
brfalse.s IL_0040: call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
call System.Boolean ꥞햜᧩檌茽ꕸꯉ껄쯕օꧽ쇗鬉�퟼萗囊�䤟::get_Exiting()
brtrue.s IL_0040: call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
ldsfld ꥞햜᧩檌茽ꕸꯉ껄쯕օꧽ쇗鬉�퟼萗囊�䤟 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::㞚墟훅ꨖ쐩鼓㷷㡀踗䨄再꥕男血ꡇ竌
callvirt System.Void ꥞햜᧩檌茽ꕸꯉ껄쯕օꧽ쇗鬉�퟼萗囊�䤟::궄눽⽢푚ᡮ䕅淂餿醛쒡肔颭鋑腒焔ß登뇟דּ()
call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::ⶔ骡鶙㵿㌶㎫แ᫩饽ﰻꚻ⡱ⓩ쁔黧ᩜ㮮()
call System.Void 擆�퇵킢ﾃ㮮⍃⚕繛圥债푦捪�崘::冇銢㷵疻믅㼗䷠魹☦荏폒顥坊㧔ᶏ泽敨()
ret <null>
CnC CNCmalicious
ethh.huhuhuhuhuhuhu
Port PORTmalicious
ethh.huhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙