Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXEafa4f1c58bdfb0656188f7879da1048cQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key kE3JN4huhuhuhuhuhuhu
Version 1.huhuhuhu
Port
Host 213.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName syhuhuhuhu
Install 1huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Clhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞔滩돾胶芲鳦寧녥ᇓࡕ䞗䛒(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ﰦ嗤鋱Ⰻ癁啸ｆ䐌닺랺�렱잧낖︗Ћჯో﷙::Ƕ漬ủฑ葻鞁ﭢ츅雿魭ㅙ眛吰⋝髞䩬訇혺ຊᤒ()
brfalse.s IL_0040: call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
call System.Boolean 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::놜릻Ꮽ辣俄➑䶀䜆⸛뮄뵑な妫羝場㎭()
brfalse.s IL_0040: call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
call System.Boolean 钷ℋ晝̜籛ﯶ㊇曻㉵ⱶ㖼掚攠뒏㴄�᪁駺::get_Exiting()
brtrue.s IL_0040: call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
ldsfld 钷ℋ晝̜籛ﯶ㊇曻㉵ⱶ㖼掚攠뒏㴄�᪁駺 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::좐떅蠽꜆ᴜ懷⏹ᑝ萱멭�灜鍾↝㈓記㑆蟥ꌌỜ
callvirt System.Void 钷ℋ晝̜籛ﯶ㊇曻㉵ⱶ㖼掚攠뒏㴄�᪁駺::騑魧ꋹᱷﰃ獁麯㐖钮찬⺽媎�衪ꀳ耶ꍈ༻呤()
call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::뼋뛊帚�꣚緇ꩉ⾵⻜䮾卮喌踴ػ夓�즀㒏臚ퟃ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞔滩돾胶芲鳦寧녥ᇓࡕ䞗䛒(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ﰦ嗤鋱Ⰻ癁啸ｆ䐌닺랺�렱잧낖︗Ћჯో﷙::Ƕ漬ủฑ葻鞁ﭢ츅雿魭ㅙ眛吰⋝髞䩬訇혺ຊᤒ()
brfalse.s IL_0040: call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
call System.Boolean 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::놜릻Ꮽ辣俄➑䶀䜆⸛뮄뵑な妫羝場㎭()
brfalse.s IL_0040: call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
call System.Boolean 钷ℋ晝̜籛ﯶ㊇曻㉵ⱶ㖼掚攠뒏㴄�᪁駺::get_Exiting()
brtrue.s IL_0040: call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
ldsfld 钷ℋ晝̜籛ﯶ㊇曻㉵ⱶ㖼掚攠뒏㴄�᪁駺 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::좐떅蠽꜆ᴜ懷⏹ᑝ萱멭�灜鍾↝㈓記㑆蟥ꌌỜ
callvirt System.Void 钷ℋ晝̜籛ﯶ㊇曻㉵ⱶ㖼掚攠뒏㴄�᪁駺::騑魧ꋹᱷﰃ獁麯㐖钮찬⺽媎�衪ꀳ耶ꍈ༻呤()
call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::鞀⃍樻䝍굪⠄澀呩ᠰᄜﻌӓ繄붝トꂭ꾄럲()
call System.Void 鵗⍃�鮵䕢㞡郟꧃᮫㤱着㰺讯◞絟ㅜꤖ力::뼋뛊帚�꣚緇ꩉ⾵⻜䮾卮喌踴ػ夓�즀㒏臚ퟃ()
ret <null>
CnC CNCmalicious
213.1huhuhuhuhuhuhu
Port PORTmalicious
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙