Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
2 malicious · 2 files
EXE8c5926309ccf26474a12265888fb77d8QuasarRat
EXE[Rebuild from dump]_078d1b6b.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 7sblKkhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port smallhuhuhuhuhuhuhu
Host smallhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory michuhuhuhu
InstallName Updathuhuhuhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey servhuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag mohuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
843
Main Method
System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::㏉瞒嚍䃁䬨Ｒ乻䢚쌙覆䨡ሱ驚텵Ḍ氎헟�଱(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ﯖ믹㶂蠼鰙ࣥ濎쩤ⴋ鹏乯⌿錁�ꑑ⑖厖飅�::쩚䒓鶇돭爹銌떮梺懬蠌쇬Ә洁ꃦ浃줲撋ꂫ()
brfalse.s IL_0040: call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
call System.Boolean 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::찼증띈ဤ맞뛦늌흍关큅塩␡ҋ캚鍮䜩⾑沤()
brfalse.s IL_0040: call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
call System.Boolean 潣᧌嶴蚰⺊杕郘载ᬋﱲ܍溼㮁⩡鑡腉⎟扰::get_Exiting()
brtrue.s IL_0040: call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
ldsfld 潣᧌嶴蚰⺊杕郘载ᬋﱲ܍溼㮁⩡鑡腉⎟扰 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::�ޕᗏ⅋禬㴯ꦕ紬㩾䤭⾸緇嚨Ɪ廖恚饟�
callvirt System.Void 潣᧌嶴蚰⺊杕郘载ᬋﱲ܍溼㮁⩡鑡腉⎟扰::ꅛ麍柽뽽푤ꅧ棣橎駎翶搀⎙澇ᮻ䰍햿⫧()
call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ఐ즾꟏ꖺꯌꑿ㮝;Ა逡ꫭ䔏믻䦾ꩯ땣꒕쎽()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
843
Main Method
System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::㏉瞒嚍䃁䬨Ｒ乻䢚쌙覆䨡ሱ驚텵Ḍ氎헟�଱(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ﯖ믹㶂蠼鰙ࣥ濎쩤ⴋ鹏乯⌿錁�ꑑ⑖厖飅�::쩚䒓鶇돭爹銌떮梺懬蠌쇬Ә洁ꃦ浃줲撋ꂫ()
brfalse.s IL_0040: call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
call System.Boolean 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::찼증띈ဤ맞뛦늌흍关큅塩␡ҋ캚鍮䜩⾑沤()
brfalse.s IL_0040: call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
call System.Boolean 潣᧌嶴蚰⺊杕郘载ᬋﱲ܍溼㮁⩡鑡腉⎟扰::get_Exiting()
brtrue.s IL_0040: call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
ldsfld 潣᧌嶴蚰⺊杕郘载ᬋﱲ܍溼㮁⩡鑡腉⎟扰 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::�ޕᗏ⅋禬㴯ꦕ紬㩾䤭⾸緇嚨Ɪ廖恚饟�
callvirt System.Void 潣᧌嶴蚰⺊杕郘载ᬋﱲ܍溼㮁⩡鑡腉⎟扰::ꅛ麍柽뽽푤ꅧ棣橎駎翶搀⎙澇ᮻ䰍햿⫧()
call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ྼ閔쫻ﲯ膏픶袩䯑졫釅䝑랧샤垳㎡틸鶀()
call System.Void 펷茨迦⒫琰蛡檶쭈⥊㼫읗煵鲅鳺浸ᇌ稘㭩쾡ᖶ::ఐ즾꟏ꖺꯌꑿ㮝;Ა逡ꫭ䔏믻䦾ꩯ땣꒕쎽()
ret <null>
CnC CNCmalicious
smallhuhuhuhuhuhuhu
Port PORTmalicious
smallhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙