Malicious
Malicious

a7ee0066dd2cf11a38226709c76c314d

PE Executable
MD5: a7ee0066dd2cf11a38226709c76c314d
Size: 2.03 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
HTML file
Size
2.03 MB · 2,027,008 B
First seen
2026-03-17 15:46 · 7 months ago
Last seen
2026-03-17 15:46 · 7 months ago
Last analysis
2026-03-17 15:51 · 7 months ago
Hashes
MD5 a7ee0066dd2cf11a38226709c76c314d Sha1 8370e6f71a2dea8dbdf739a549f740c98153246f Sha256 feec3cf0f4281220ada2bb20bd59a3254e7543d65631a4a0deae019ffc15d277 Sha384 ccc763ccfb6ee1bc58cad8d6503218383a50b43ea8e5901ef211fcfe1b7e9a9cacab592a876d0c89f300946826e85a00 Sha512 99c34a5b29e90383e7b3af00cae219d7858d2a85b8b55f490facc38eda3931a0298c2a377c3696dee2cf5a76f974e68f4261f9336f03860f67ecffaa4f35a2f4 SSDeep 49152:DcSNWnn7wRPirm2NnPTKKm77LrwCB6uanKy:DR0MoZNn2Km77LrwkFW TLSH 7395F050B7F6811AF2FF6BB9A8B718490B37B903EA36D74E0888605D1EB77409D51363
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 103 files
EXEa7ee0066dd2cf11a38226709c76c314dQuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINPulsar.Client.FrmRemoteChat.resources
BINcostura.aforge.dll.compressed
DLLcostura.aforge.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.aforge.video.dll.compressed
DLLcostura.aforge.video.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.aforge.video.directshow.dll.compressed
DLLcostura.aforge.video.directshow.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINAForge.Video.DirectShow.Properties.Resources.resources
BINcamera
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAForge.Video.DirectShow.VideoCaptureDeviceForm.resources
BINcostura.gma.system.mousekeyhook.dll.compressed
DLLcostura.gma.system.mousekeyhook.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.naudio.core.dll.compressed
DLLcostura.naudio.core.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.naudio.wasapi.dll.compressed
DLLcostura.naudio.wasapi.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.naudio.winforms.dll.compressed
DLLcostura.naudio.winforms.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINNAudio.WinForms.Gui.PanSlider.resources
BIN$this.DefaultModifiers
BIN$this.GridSize
BIN$this.Language
BINNAudio.WinForms.Gui.VolumeSlider.resources
BINcostura.naudio.winmm.dll.compressed
DLLcostura.naudio.winmm.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.protobuf-net.dll.compressed
DLLcostura.protobuf-net.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.protobuf-net.core.dll.compressed
DLLcostura.protobuf-net.core.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.dll.compressed
DLLcostura.sharpdx.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.pdb.compressed
PDBcostura.sharpdx.pdb
BINcostura.sharpdx.d3dcompiler.dll.compressed
DLLcostura.sharpdx.d3dcompiler.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.d3dcompiler.pdb.compressed
PDBcostura.sharpdx.d3dcompiler.pdb
BINcostura.sharpdx.direct2d1.dll.compressed
DLLcostura.sharpdx.direct2d1.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.direct2d1.pdb.compressed
PDBcostura.sharpdx.direct2d1.pdb
BINcostura.sharpdx.direct3d11.dll.compressed
DLLcostura.sharpdx.direct3d11.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.direct3d11.pdb.compressed
PDBcostura.sharpdx.direct3d11.pdb
BINcostura.sharpdx.dxgi.dll.compressed
DLLcostura.sharpdx.dxgi.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.dxgi.pdb.compressed
PDBcostura.sharpdx.dxgi.pdb
BINcostura.sharpdx.mathematics.dll.compressed
DLLcostura.sharpdx.mathematics.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.mathematics.pdb.compressed
PDBcostura.sharpdx.mathematics.pdb
BINcostura.system.buffers.dll.compressed
DLLcostura.system.buffers.dll
Structure
P7B[Authenticode]_8c38879e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Buffers.SR.resources
BINcostura.system.collections.immutable.dll.compressed
DLLcostura.system.collections.immutable.dll
Structure
P7B[Authenticode]_16f812e0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Collections.Immutable.SR.resources
XMLILLink.Substitutions.xml
BINcostura.system.memory.dll.compressed
DLLcostura.system.memory.dll
Structure
P7B[Authenticode]_15ab3250.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Memory.SR.resources
BINcostura.system.numerics.vectors.dll.compressed
DLLcostura.system.numerics.vectors.dll
Structure
P7B[Authenticode]_ae030d4d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Numerics.Vectors.SR.resources
BINcostura.system.runtime.compilerservices.unsafe.dll.compressed
DLLcostura.system.runtime.compilerservices.unsafe.dll
Structure
P7B[Authenticode]_e61c97b9.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.pulsar.common.dll.compressed
DLLcostura.pulsar.common.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.metadata
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
EncryptionKey 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PDB Path: ?
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.6.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
2163
Main Method
System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Main IL Instruction Count
11
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::P4IR11k3clAOGvo51PAc()
newobj System.Void knmcswnvpcyvlx.MmxmNfU4DhHL8Y8a::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.6.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
2163
Main Method
System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Main IL Instruction Count
11
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::P4IR11k3clAOGvo51PAc()
newobj System.Void knmcswnvpcyvlx.MmxmNfU4DhHL8Y8a::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
Chainhuhuhuhuhuhuhu
Port PORTmalicious
Chainhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 103 files
EXEa7ee0066dd2cf11a38226709c76c314dQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
EncryptionKey 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
Chainhuhuhuhuhuhuhu
a7ee0066dd2cf11a38226709c76c314d
Port PORTmalicious
Chainhuhuhuhuhuhuhu
a7ee0066dd2cf11a38226709c76c314d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙