Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 10 files
EXEb0951435e996097ed5140003032a364bQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key x0lGqHhuhuhuhuhuhuhu
Version 2.huhuhuhu
Port 4huhuhuhu
Host 127huhuhuhu
ReconnectDelay 3huhuhuhu
Key cfwy85huhuhuhuhuhuhu
SubDirectory fIv3ULhuhuhuhuhuhuhuhuhuhuhu
InstallName Suhuhuhuhu
Install Clihuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey VNM_Mhuhuhuhuhuhuhu
HideFile Cliehuhuhuhuhuhuhu
EnableLogger 1huhuhuhu
EncryptionKey 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
$77-Venom.exe
Full Name
$77-Venom.exe
EntryPoint
System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::Main(System.String[])
Scope Name
$77-Venom.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
$77-Venom
Assembly Version
2.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
2085
Main Method
System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::Main(System.String[])
Main IL Instruction Count
21
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::⛧졯鶄嘑躂�㡘솬ꪾ磥⪝Ð诃㔐ퟥ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 递㏭䊺녝ᚇꛖ뮡鼱⨀澂ኲ퐤㋹ᔲꢶ::收싳拘�䣪潑؁ᩱ鯅秇奠峘퇓ᷣ蜵䅟펗()
brfalse.s IL_0040: call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
call System.Boolean 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::☹챐퍯衫뺧獯隫⯼烠Ⓣ倽蘿䰝쪉ܧଡ଼ﮙ䯧咙㘛()
brfalse.s IL_0040: call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
call System.Boolean 枸W൶䡟龔穨帑맒킠䍫暍຦স䣧㒼롒妨�௝鳩::get_Exiting()
brtrue.s IL_0040: call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
ldsfld 枸W൶䡟龔穨帑맒킠䍫暍຦স䣧㒼롒妨�௝鳩 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::ࡃࡾ毇嫛䑥ꍫ괔酩Ω䨶ल꿡⹔浳瓨䅍阡쟹刧촥
callvirt System.Void 枸W൶䡟龔穨帑맒킠䍫暍຦স䣧㒼롒妨�௝鳩::╲㪷は瑻↲黜ᆿ됑ힾ쩃㫼ẅォ횫❻糖뾸䎱()
call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
call System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::�䂸瑍끡㝌욠쓩柪￫뵔梐೐뇔宑ꉓ靖틛()
call System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::䇦肼흁踮楒”누㱵砳萫㪋碹䣸ਰ⡿⥏挫粸‒()
call System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::撟聏亃䨵ⳓꎿ⫏䝑篰⥊́嚘獶⥔ꆃꛇ()
ret <null>
Module Name
$77-Venom.exe
Full Name
$77-Venom.exe
EntryPoint
System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::Main(System.String[])
Scope Name
$77-Venom.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
$77-Venom
Assembly Version
2.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
2085
Main Method
System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::Main(System.String[])
Main IL Instruction Count
21
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::⛧졯鶄嘑躂�㡘솬ꪾ磥⪝Ð诃㔐ퟥ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 递㏭䊺녝ᚇꛖ뮡鼱⨀澂ኲ퐤㋹ᔲꢶ::收싳拘�䣪潑؁ᩱ鯅秇奠峘퇓ᷣ蜵䅟펗()
brfalse.s IL_0040: call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
call System.Boolean 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::☹챐퍯衫뺧獯隫⯼烠Ⓣ倽蘿䰝쪉ܧଡ଼ﮙ䯧咙㘛()
brfalse.s IL_0040: call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
call System.Boolean 枸W൶䡟龔穨帑맒킠䍫暍຦স䣧㒼롒妨�௝鳩::get_Exiting()
brtrue.s IL_0040: call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
ldsfld 枸W൶䡟龔穨帑맒킠䍫暍຦স䣧㒼롒妨�௝鳩 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::ࡃࡾ毇嫛䑥ꍫ괔酩Ω䨶ल꿡⹔浳瓨䅍阡쟹刧촥
callvirt System.Void 枸W൶䡟龔穨帑맒킠䍫暍຦স䣧㒼롒妨�௝鳩::╲㪷は瑻↲黜ᆿ됑ힾ쩃㫼ẅォ횫❻糖뾸䎱()
call System.Void ꠽ꉕ‱㟩싻냐⏵⚙簥䥠ڰ뭤︷ࣙ᮲밥::뼗⚔츆썣鰤븷巤夔�ﰪ몧齧籛韽묞퐸룓ⅻ韅()
call System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::�䂸瑍끡㝌욠쓩柪￫뵔梐೐뇔宑ꉓ靖틛()
call System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::䇦肼흁踮楒”누㱵砳萫㪋碹䣸ਰ⡿⥏挫粸‒()
call System.Void 蘐�寝줍Ƃ耯ⅆ읆笔꟒裎졟�⮳ᖷ况緱䓈沈폴::撟聏亃䨵ⳓꎿ⫏䝑篰⥊́嚘獶⥔ꆃꛇ()
ret <null>
CnC CNCmalicious
127huhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙