Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXE9af2fa00f1796e20cead33d3f7b7a373QuasarRat
EXE[Rebuild from dump]_42655c3b.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host RgNSTMhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host VYJjpyhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host DqUTFahuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host QVggEphuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host yPZmTJhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host ytXDZUhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host ByZBzehuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host DGnZQjhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host JDIsOihuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host moNxVthuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host QfFaRBhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host FHXvaxhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host xMfLSMhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host RHjqJChuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host o6tqyuhuhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key eES6SBhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host jwy1nwhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 3oFWIvhuhuhuhuhuhuhu
AuthKey wjsDuVhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex DSmEzhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag XXXhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::툮͌䧛Ꮩ麳�친苊镽ൄ⁲죽Ꮎ䫐Ỽ⽹쓫몝(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 舲割ᤓ庿侌䇫쿽᜙�許잞泓轥젍忙筃뎕훚::瑶�侩狁靦噦귎羭ľ墥淼䧗뚩혾ꈼ㉬()
brfalse.s IL_0040: call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
call System.Boolean 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::ၐ췭�琦᠍誜룯㺸펶퀙฿탦䐚惁륫ἕ깓鰷()
brfalse.s IL_0040: call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
call System.Boolean �腌깙䫩損육㥮Ử⪫䞯蹢䦺䒸ઈ᩟ᛦᢳ옳ࡕ::get_Exiting()
brtrue.s IL_0040: call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
ldsfld �腌깙䫩損육㥮Ử⪫䞯蹢䦺䒸ઈ᩟ᛦᢳ옳ࡕ 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::炸弜㼋糠蒿拰馒ꣴŢ鲣丠┝쟹㩞옏빼蟺쭺☶
callvirt System.Void �腌깙䫩損육㥮Ử⪫䞯蹢䦺䒸ઈ᩟ᛦᢳ옳ࡕ::쐦軚鋈烜�ꦭ晑滚さ闧㔍椈ଘ퀕끁()
call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::옙墅￐텉輰䴭倮溹荜�鹂鸷楹꺟똛訣()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::툮͌䧛Ꮩ麳�친苊镽ൄ⁲죽Ꮎ䫐Ỽ⽹쓫몝(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 舲割ᤓ庿侌䇫쿽᜙�許잞泓轥젍忙筃뎕훚::瑶�侩狁靦噦귎羭ľ墥淼䧗뚩혾ꈼ㉬()
brfalse.s IL_0040: call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
call System.Boolean 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::ၐ췭�琦᠍誜룯㺸펶퀙฿탦䐚惁륫ἕ깓鰷()
brfalse.s IL_0040: call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
call System.Boolean �腌깙䫩損육㥮Ử⪫䞯蹢䦺䒸ઈ᩟ᛦᢳ옳ࡕ::get_Exiting()
brtrue.s IL_0040: call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
ldsfld �腌깙䫩損육㥮Ử⪫䞯蹢䦺䒸ઈ᩟ᛦᢳ옳ࡕ 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::炸弜㼋糠蒿拰馒ꣴŢ鲣丠┝쟹㩞옏빼蟺쭺☶
callvirt System.Void �腌깙䫩損육㥮Ử⪫䞯蹢䦺䒸ઈ᩟ᛦᢳ옳ࡕ::쐦軚鋈烜�ꦭ晑滚さ闧㔍椈ଘ퀕끁()
call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::턻疗亀籲臲⥄ᴀ긽紕䱽遏꾘鶕歫殳㑦曮はẺᄨ()
call System.Void 砭ⴈ꛲〃ӽ࣢בֿ○邝৫ᔕ鴚Ⱛᛂ�⟊岱䅃::옙墅￐텉輰䴭倮溹荜�鹂鸷楹꺟똛訣()
ret <null>
CnC CNCmalicious
jwy1nwhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
o6tqyuhuhuhuhuhuhuhuhuhuhuhu
CnC CNCmalicious
RHjqJChuhuhuhuhuhuhu
CnC CNCmalicious
xMfLSMhuhuhuhuhuhuhu
CnC CNCmalicious
FHXvaxhuhuhuhuhuhuhu
CnC CNCmalicious
QfFaRBhuhuhuhuhuhuhu
CnC CNCmalicious
moNxVthuhuhuhuhuhuhu
CnC CNCmalicious
JDIsOihuhuhuhuhuhuhu
CnC CNCmalicious
DGnZQjhuhuhuhuhuhuhu
CnC CNCmalicious
ByZBzehuhuhuhuhuhuhu
CnC CNCmalicious
ytXDZUhuhuhuhuhuhuhu
CnC CNCmalicious
yPZmTJhuhuhuhuhuhuhu
CnC CNCmalicious
QVggEphuhuhuhuhuhuhu
CnC CNCmalicious
DqUTFahuhuhuhuhuhuhu
CnC CNCmalicious
VYJjpyhuhuhuhuhuhuhu
CnC CNCmalicious
RgNSTMhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙