Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 3 files
EXEa534a3d4aa218545b901f19788dfd1aeQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key n7ts9Vhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 15huhuhuhu
Host 15huhuhuhu
Conf. AES-Key n7ts9Vhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 2huhuhuhu
Host mac-m4huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory svchhuhuhuhu
InstallName sservhuhuhuhuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey ssehuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag VIPPhuhuhuhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::떏᯳ᬡ纖䚊並੭ኸ浸䤬凕鋕�剎ӏꬑ뙋쑡꺿(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean Ꝭ૦⚡탯퓴쵏Ḍ캙푥둱㭷㊇�쉥嵩⅌�濨䆣苌::శ폥㻊形磱紺鎉扇팇彃Ꮊ⥘�欻�骒鱝券()
brfalse.s IL_0040: call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
call System.Boolean 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ᑩ繫�ඈ瑧Ꭷ敛慖⍯ꁆ硆洠쇸Ѥ䬤ꊠ蒜틿䐌혯()
brfalse.s IL_0040: call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
call System.Boolean 簨蚙徱맲焚넢吏￡饬铢䔥歸绂炉虞赕씀秎::get_Exiting()
brtrue.s IL_0040: call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
ldsfld 簨蚙徱맲焚넢吏￡饬铢䔥歸绂炉虞赕씀秎 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::╯㠽㉔篠﹝黑떠쨾邖ꛘ客呎ꏎ덯ࣣ䙚졬㆟礪
callvirt System.Void 簨蚙徱맲焚넢吏￡饬铢䔥歸绂炉虞赕씀秎::［㜈䛝␵嬨뮠越꿮툕힎值얐鈴͸掝䖝罡㽠()
call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::㸺藸튭茣媒뜼ে㤤೏琨ᆵޒ呠ꝴ䩤琋猴쑮()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::떏᯳ᬡ纖䚊並੭ኸ浸䤬凕鋕�剎ӏꬑ뙋쑡꺿(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean Ꝭ૦⚡탯퓴쵏Ḍ캙푥둱㭷㊇�쉥嵩⅌�濨䆣苌::శ폥㻊形磱紺鎉扇팇彃Ꮊ⥘�欻�骒鱝券()
brfalse.s IL_0040: call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
call System.Boolean 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ᑩ繫�ඈ瑧Ꭷ敛慖⍯ꁆ硆洠쇸Ѥ䬤ꊠ蒜틿䐌혯()
brfalse.s IL_0040: call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
call System.Boolean 簨蚙徱맲焚넢吏￡饬铢䔥歸绂炉虞赕씀秎::get_Exiting()
brtrue.s IL_0040: call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
ldsfld 簨蚙徱맲焚넢吏￡饬铢䔥歸绂炉虞赕씀秎 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::╯㠽㉔篠﹝黑떠쨾邖ꛘ客呎ꏎ덯ࣣ䙚졬㆟礪
callvirt System.Void 簨蚙徱맲焚넢吏￡饬铢䔥歸绂炉虞赕씀秎::［㜈䛝␵嬨뮠越꿮툕힎值얐鈴͸掝䖝罡㽠()
call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::ﵵ≿ϑ⹟텽퉛⥸艪៰ᒓ契螝뛭᎛쯱옜莈()
call System.Void 㨤잵෸⩮�얖ᔔ酭䨵⥽翐ㅉ顥콘욺ꑛ�殯::㸺藸튭茣媒뜼ে㤤೏琨ᆵޒ呠ꝴ䩤琋猴쑮()
ret <null>
CnC CNCmalicious
mac-m4huhuhuhuhuhuhu
Port PORTmalicious
2huhuhuhu
CnC CNCmalicious
15huhuhuhu
Port PORTmalicious
15huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙