Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXEab41de30dc003ab0babf14f61c1b1d73QuasarRat
EXE[Rebuild from dump]_3b726747.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key BBCDS2huhuhuhuhuhuhu
Version 1.huhuhuhu
Port alexihuhuhuhuhuhuhu
Host alexihuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Cliehuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag nhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::᧿㜌䉐陗쀲酱쾑혒乡戍砭殸㔯鲯ႈ癣戌鵖(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ሔ亚ꩩ精⣶䦇音龩醕翮ꧪꦒፀ≥馔�碾䵸艹::鳹洎䣸䬸䏔藿죋축㹶䍿콗姩ㅽ꬚桌섥⾧()
brfalse.s IL_0040: call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
call System.Boolean 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::ჱ�薸耔ଠ䄬ァ�율珧⟫裡ۙᔳᘬ铄ꠞﻴ魷()
brfalse.s IL_0040: call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
call System.Boolean 处붎劉䇢譄fi∼梄睨ਹ露⣝ͫ薎Ӈޟ৆곜::get_Exiting()
brtrue.s IL_0040: call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
ldsfld 处붎劉䇢譄fi∼梄睨ਹ露⣝ͫ薎Ӈޟ৆곜 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::쒎䆝䘻⋌ﹱ飰㏣炪㫷檰䵓蟉鶤䂡謫ᅨ잉⧹
callvirt System.Void 处붎劉䇢譄fi∼梄睨ਹ露⣝ͫ薎Ӈޟ৆곜::︒呠뺽냒坐翻쉙軞䳂쐃㞕ᣌ횪濿᎚뚅ꤵ䍇彫()
call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::ழቴ섇ꛩ砻✀쐪ᦰ栖붹貽풃侅堕喧‌()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::᧿㜌䉐陗쀲酱쾑혒乡戍砭殸㔯鲯ႈ癣戌鵖(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ሔ亚ꩩ精⣶䦇音龩醕翮ꧪꦒፀ≥馔�碾䵸艹::鳹洎䣸䬸䏔藿죋축㹶䍿콗姩ㅽ꬚桌섥⾧()
brfalse.s IL_0040: call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
call System.Boolean 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::ჱ�薸耔ଠ䄬ァ�율珧⟫裡ۙᔳᘬ铄ꠞﻴ魷()
brfalse.s IL_0040: call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
call System.Boolean 处붎劉䇢譄fi∼梄睨ਹ露⣝ͫ薎Ӈޟ৆곜::get_Exiting()
brtrue.s IL_0040: call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
ldsfld 处붎劉䇢譄fi∼梄睨ਹ露⣝ͫ薎Ӈޟ৆곜 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::쒎䆝䘻⋌ﹱ飰㏣炪㫷檰䵓蟉鶤䂡謫ᅨ잉⧹
callvirt System.Void 处붎劉䇢譄fi∼梄睨ਹ露⣝ͫ薎Ӈޟ৆곜::︒呠뺽냒坐翻쉙軞䳂쐃㞕ᣌ횪濿᎚뚅ꤵ䍇彫()
call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::d�餃ꏞꝨ㉕卯ៜ婌蛚�똜፱꓈⛝▻啍褭Ƴ()
call System.Void 컱昉㓩䓴崇坖づ「侤⎢썻ⱙಚ䗄磃葃㍁蔦ꮏ뾣::ழቴ섇ꛩ砻✀쐪ᦰ栖붹貽풃侅堕喧‌()
ret <null>
CnC CNCmalicious
alexihuhuhuhuhuhuhu
Port PORTmalicious
alexihuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙