Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXE8d705fc22e8a9a71ddadfcadb99e8cd3QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key U5pmZWhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host effecthuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::쳰諧킶裡欆헷䥥癫橷䠁ᖙ㠮儹䙰뗔Ӌ瓇람땓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ᚥ쇸롻ኃῈ｝㲢ᣚꇿ쒆좪鵔崚㰞鞤赁阏艭ꏇ::격믖霠巸哝髫㭐햱ꂝ俩埙䃳笊�瞰쌘鮔꡵()
brfalse.s IL_0040: call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
call System.Boolean ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::䔸錍冴ꐦ⚡绦ᐝ쐏蛜펃횅맼鼱Ӑ᷽⩸⪠()
brfalse.s IL_0040: call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
call System.Boolean 蕗ଡ଼᪒䒩고캍ᰙ撻臌뢝亶㯚䍋묥켥ᾠꉫ::get_Exiting()
brtrue.s IL_0040: call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
ldsfld 蕗ଡ଼᪒䒩고캍ᰙ撻臌뢝亶㯚䍋묥켥ᾠꉫ ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::瀖㍠褖紫橌쪩♓㓵㻬列슨䢔势�雯㸟誷瀧砀鯟
callvirt System.Void 蕗ଡ଼᪒䒩고캍ᰙ撻臌뢝亶㯚䍋묥켥ᾠꉫ::⧜䞢㩗秳윖裝䙖탃ﴇᑪꮦ鰙斮먉Χ慏梅谽()
call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::ᙖ럻壬靭稜搡ၵ慧沽悆牋픷�褯䠻笓㧰块()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::쳰諧킶裡欆헷䥥癫橷䠁ᖙ㠮儹䙰뗔Ӌ瓇람땓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ᚥ쇸롻ኃῈ｝㲢ᣚꇿ쒆좪鵔崚㰞鞤赁阏艭ꏇ::격믖霠巸哝髫㭐햱ꂝ俩埙䃳笊�瞰쌘鮔꡵()
brfalse.s IL_0040: call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
call System.Boolean ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::䔸錍冴ꐦ⚡绦ᐝ쐏蛜펃횅맼鼱Ӑ᷽⩸⪠()
brfalse.s IL_0040: call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
call System.Boolean 蕗ଡ଼᪒䒩고캍ᰙ撻臌뢝亶㯚䍋묥켥ᾠꉫ::get_Exiting()
brtrue.s IL_0040: call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
ldsfld 蕗ଡ଼᪒䒩고캍ᰙ撻臌뢝亶㯚䍋묥켥ᾠꉫ ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::瀖㍠褖紫橌쪩♓㓵㻬列슨䢔势�雯㸟誷瀧砀鯟
callvirt System.Void 蕗ଡ଼᪒䒩고캍ᰙ撻臌뢝亶㯚䍋묥켥ᾠꉫ::⧜䞢㩗秳윖裝䙖탃ﴇᑪꮦ鰙斮먉Χ慏梅谽()
call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::礴ぉ駧�액悩䁐桫鹎ꥍ귽徆ⶰ葉炭ᗑ鴿웽Ǚ()
call System.Void ܖ痴羽秫뷚ⓡ௠甅釒쾶컧鴨밇슫鮳ꇦ䔓㉍::ᙖ럻壬靭稜搡ၵ慧沽悆牋픷�褯䠻笓㧰块()
ret <null>
CnC CNCmalicious
effecthuhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙