8bef9a2dd87e19ad863726fe3b33bf0c

PE Executable
|
MD5: 8bef9a2dd87e19ad863726fe3b33bf0c
|
Size: 356.35 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	8bef9a2dd87e19ad863726fe3b33bf0c
Sha1	b9b339531c617fc70227edb970aa918f47f6015a
Sha256	eeb612949e0c08f8aed99e6ac2dd4351336904bcb1961fdd9295e924bc3fbb6d
Sha384	d2e4ee18db2d376a0eb15eed56d641da5209be39e1ef3c04d534538990cdff8debb812eaabba36e7facce6755fbceb70
Sha512	478d5610cd916a0318f8ec8a6b26bd532ff3fb3a49ba1d707d9b7cd76d105a1f5d74f4bd866db6e339d52e8e08e01bf11845b80e1d437c95cee4bba5e0620c05
SSDeep	6144:lB6bPXhLApfpOimzVv6JSbycvob6H47de+TEXSe:3mhApfmViGo+Yxe0EXSe
TLSH	E0747C1333A4EA3FD1FD173AE4324A164BB0D4477626E39B5A5865F92C133968D823B3

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - QuasarRAT config.

Config. Field0	Value
Conf. AES-Salt	BF-EB-1E-56-FB-CD-97-3B-B2-19-02-24-30-A5-78-43-00-3D-56-44-D2-1E-62-B9-D4-F1-80-E7-E6-C3-39-41
Conf. AES-Key	qMha1sv2dyaj4Dbgljva
Version	1.3.0.0
Port
Host	213.142.159.116
ReconnectDelay	3000
Key	1WvgEMPjdwfqIMeM9MclyQ==
AuthKey	NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==
SubDirectory	SubDir
InstallName	syss.exe
Install	1
Startup	0
Mutex	QSR_MUTEX_ywpdDT
StartupKey	Client
HideFile	0
EnableLogger	1
Tag	Office04
LogDirectory	Logs
HideLogDirectory	0
HideLogSubdirectory	0

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::紈齚�呌䷙丬嶊汛㡚�㣚䑍탴℃쭼⡴䇗䌓햍(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 骘䒟酫ꭣᧅ삧샂촶淦醨ꉦ鴳螱翙쎓궹投::蠡霵ﰆ轡糬ἓ金⽯ㅕ�뭀᭘禹琺퉪⏿阄㾉濱() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::⪢餻ꡃ孌纺岚꟡滽淣ؔ㉨率ᖯ肳⩊弔() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::get_Exiting() brtrue.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() ldsfld 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯 ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::덕⍴や꠳ꁘ敁扡阗䋿氒璿︱ꍈꊛỏȒ䝓葸 callvirt System.Void 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::메쮪ᾎ�鷺鞪擼ٷ婢䰽亊챡膚֘宷襺�() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Ꮢ趘䄐力씄읣黓ꩅ倸쪦㨢�捯씳ᡰ⪯�榃鈬⬟() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::紈齚�呌䷙丬嶊汛㡚�㣚䑍탴℃쭼⡴䇗䌓햍(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 骘䒟酫ꭣᧅ삧샂촶淦醨ꉦ鴳螱翙쎓궹投::蠡霵ﰆ轡糬ἓ金⽯ㅕ�뭀᭘禹琺퉪⏿阄㾉濱() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::⪢餻ꡃ孌纺岚꟡滽淣ؔ㉨率ᖯ肳⩊弔() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::get_Exiting() brtrue.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() ldsfld 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯 ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::덕⍴や꠳ꁘ敁扡阗䋿氒璿︱ꍈꊛỏȒ䝓葸 callvirt System.Void 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::메쮪ᾎ�鷺鞪擼ٷ婢䰽亊챡膚֘宷襺�() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Ꮢ趘䄐力씄읣黓ꩅ倸쪦㨢�捯씳ᡰ⪯�榃鈬⬟() ret <null>

Artefacts

Name0	Value
CnC	213.142.159.116
Port

8bef9a2dd87e19ad863726fe3b33bf0c (356.35 KB)