Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXEb1de80c43d7da5347a2eea66debcb5eeQuasarRat
EXE[Rebuild from dump]_c968264e.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key bshp2Bhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port kamalhuhuhuhuhuhuhu
Host kamalhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory shuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag shuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::፠麧兾Ƨ旾ꖧ鰘ꛇ챠䮓и쒣ࡨ�歎ꎫ忌鑚ﴕ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ꅖ鱽�뮹ፊ莝윫켡鸏᪰ຂ葈Ѩ좇蔮싐㨴䷊㑝蜡::槮嵾瓃ﮏ疵익憗뷩쳻敌꒽꜒Ⲟ鴭䠤琭ퟄዲ馶()
brfalse.s IL_0040: call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
call System.Boolean �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::醯␔᤯튂ꈄ酖䍎槞岜鼃켲ᴏ덍鮚ꜣ貤萤()
brfalse.s IL_0040: call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
call System.Boolean 危ဍ濉滟鈅湴ろ䚙졧蠐质貱ރ魤ա踱ꢈ蠤㪒呻::get_Exiting()
brtrue.s IL_0040: call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
ldsfld 危ဍ濉滟鈅湴ろ䚙졧蠐质貱ރ魤ա踱ꢈ蠤㪒呻 �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::㴯㪾냧㣘忚ﴷ⟚咒쓱卑㠞阞쎂힇�쉋ꨱ�먚
callvirt System.Void 危ဍ濉滟鈅湴ろ䚙졧蠐质貱ރ魤ա踱ꢈ蠤㪒呻::马몣اꋺ펖홞㓔ⳃ呎ႈ䇗愙藑뫟塞涡ꯧᘏ()
call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::ᓲ䂄匔紻ꟾ㽗셠㶃澘䑴䢪윅쐓♾䙧ꗏ䣩띥()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::፠麧兾Ƨ旾ꖧ鰘ꛇ챠䮓и쒣ࡨ�歎ꎫ忌鑚ﴕ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ꅖ鱽�뮹ፊ莝윫켡鸏᪰ຂ葈Ѩ좇蔮싐㨴䷊㑝蜡::槮嵾瓃ﮏ疵익憗뷩쳻敌꒽꜒Ⲟ鴭䠤琭ퟄዲ馶()
brfalse.s IL_0040: call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
call System.Boolean �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::醯␔᤯튂ꈄ酖䍎槞岜鼃켲ᴏ덍鮚ꜣ貤萤()
brfalse.s IL_0040: call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
call System.Boolean 危ဍ濉滟鈅湴ろ䚙졧蠐质貱ރ魤ա踱ꢈ蠤㪒呻::get_Exiting()
brtrue.s IL_0040: call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
ldsfld 危ဍ濉滟鈅湴ろ䚙졧蠐质貱ރ魤ա踱ꢈ蠤㪒呻 �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::㴯㪾냧㣘忚ﴷ⟚咒쓱卑㠞阞쎂힇�쉋ꨱ�먚
callvirt System.Void 危ဍ濉滟鈅湴ろ䚙졧蠐质貱ރ魤ա踱ꢈ蠤㪒呻::马몣اꋺ펖홞㓔ⳃ呎ႈ䇗愙藑뫟塞涡ꯧᘏ()
call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::䵺ՙ㺂ᶋ慸ꠓ伔㕂௿׮뿜؟댊鈸腀簇()
call System.Void �䛠䡼�♍铥鐆뢀ൺᜆ讣㩼〈፸ፎ呤뙣뎦::ᓲ䂄匔紻ꟾ㽗셠㶃澘䑴䢪윅쐓♾䙧ꗏ䣩띥()
ret <null>
CnC CNCmalicious
kamalhuhuhuhuhuhuhu
Port PORTmalicious
kamalhuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙