Malicious
Malicious

PE Executable
MD5: a22c877d7b28714a5b3e6cb3a3149fc7
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
376.84 KB · 376,844 B
First seen
2025-11-23 00:08 · 11 months ago
Last seen
2025-11-23 00:08 · 11 months ago
Last analysis
2025-11-23 00:10 · 11 months ago
Hashes
MD5 a22c877d7b28714a5b3e6cb3a3149fc7 Sha1 6863d78a6326315a51469aedff66d311ac0d962a Sha256 39d9d007292ecc941d6e8232b0c0680fd444b60026c1549464c42be61d4b9d1b Sha384 0735b8101d9730f43418346e3a1a2821002769bfa76de93b1ce41be04496753ab9c5b2be539e703677ff18da8e6f177d Sha512 4f778a2b89d5af505d527bf0d9f69cb9fbf942a7a003bb0e87b00b30aad63cfebe0cb525acce68166f25df7445f67c9f2a87e70b4f7241df3f5e8b7267e10529 SSDeep 6144:fU6bPXhLApfpgITWIGJSvbFyXL+BY079vrulMFo+O:8mhApVTWIGYhy7Kf79zulMPO TLSH 10849C5377A4E93BD1FE1B36E43616158BB0D403BE1AE38B5A5845B93D133868E803B7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXEa22c877d7b28714a5b3e6cb3a3149fc7QuasarRat
EXE[Rebuild from dump]_5f2c1271.exeQuasarRat
BIN.Net Resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 7VXTxthuhuhuhuhuhuhu
Version 1.huhuhuhu
Port windohuhuhuhuhuhuhu
Host windohuhuhuhuhuhuhu
ReconnectDelay 2huhuhuhu
Key oXCnUihuhuhuhuhuhuhu
AuthKey h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory uhuhuhuhu
InstallName jsthuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey uphuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Nhuhuhuhu
LogDirectory lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Ꭸ鴎瓐明Ď襪低⍢阴딗꿮빢鐥娆ɑ瓤䊳�(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 釺ᣛ珲サኮ蜩군쫡힧骄늧ꇂ鯴嘈䀨䉪챹�౏ࣈ::뙏转࢐Ｒ剟ꀘ퇀�Ꮂ佮돝訩螬柉䘕濏懄()
brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
call System.Boolean ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::孳஝瘿꣟탞בֿﯬ溋堃櫓�릁䔣煡()
brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
call System.Boolean 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::get_Exiting()
brtrue.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
ldsfld 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎ ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::诂዆໚瞨剄풠Ꞅ褡黲뮺適铝ꫦᄗ洳델
callvirt System.Void 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::緵ꤐ�ᯢၸ㠙跛烽䬎梔獐鎡ᓆ収簬삨䧝瞢()
call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::瑪䲢匘셨別ꊴ섑댛뷇㳮뻤Ꝋ䙵᧹⪢乽Ⱟ⮤()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Ꭸ鴎瓐明Ď襪低⍢阴딗꿮빢鐥娆ɑ瓤䊳�(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 釺ᣛ珲サኮ蜩군쫡힧骄늧ꇂ鯴嘈䀨䉪챹�౏ࣈ::뙏转࢐Ｒ剟ꀘ퇀�Ꮂ佮돝訩螬柉䘕濏懄()
brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
call System.Boolean ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::孳஝瘿꣟탞בֿﯬ溋堃櫓�릁䔣煡()
brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
call System.Boolean 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::get_Exiting()
brtrue.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
ldsfld 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎ ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::诂዆໚瞨剄풠Ꞅ褡黲뮺適铝ꫦᄗ洳델
callvirt System.Void 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::緵ꤐ�ᯢၸ㠙跛烽䬎梔獐鎡ᓆ収簬삨䧝瞢()
call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ()
call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::瑪䲢匘셨別ꊴ섑댛뷇㳮뻤Ꝋ䙵᧹⪢乽Ⱟ⮤()
ret <null>
CnC CNCmalicious
windohuhuhuhuhuhuhu
Port PORTmalicious
windohuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2 malicious · 6 files
EXEa22c877d7b28714a5b3e6cb3a3149fc7QuasarRat
EXE[Rebuild from dump]_5f2c1271.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 7VXTxthuhuhuhuhuhuhu
Version 1.huhuhuhu
Port windohuhuhuhuhuhuhu
Host windohuhuhuhuhuhuhu
ReconnectDelay 2huhuhuhu
Key oXCnUihuhuhuhuhuhuhu
AuthKey h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory uhuhuhuhu
InstallName jsthuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey uphuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag Nhuhuhuhu
LogDirectory lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
windohuhuhuhuhuhuhu
a22c877d7b28714a5b3e6cb3a3149fc7
Port PORTmalicious
windohuhuhuhuhuhuhu
a22c877d7b28714a5b3e6cb3a3149fc7
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
a22c877d7b28714a5b3e6cb3a3149fc7
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙