Malicious
Malicious

bfe808e10d23b68f35b4e0e368c3ef25

PE Executable
MD5: bfe808e10d23b68f35b4e0e368c3ef25
Size: 295.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
295.42 KB · 295,424 B
First seen
2025-11-23 01:12 · 11 months ago
Last seen
2025-11-23 01:12 · 11 months ago
Last analysis
2025-11-23 01:13 · 11 months ago
Hashes
MD5 bfe808e10d23b68f35b4e0e368c3ef25 Sha1 a277799d39fc6edfe9685e1591c8cbcbb146beba Sha256 fac79110f89632dd781e18a2c7a546512b25be68fd0be7ed03ed2adde4bd6237 Sha384 c00b278b8266ed3e80d7266b04e388a7f74c89451b7ffcc9d515a852fc4e73d849d0826dd335cc211190bb3beea47515 Sha512 d39efb30dc4b3fd83b30fc56d67ba5c14ba5d8e9e971eaad3555f89d4ea7eba662560a22536e55bc5d35066d3c86876e210cb7f0ddd5aa7848aa706881d7658a SSDeep 6144:uKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkMCC:1zCGL69zVGkllbkM/ TLSH 1D545A2527F8A93BD9BE17B4F43141094BB6FC07B557F38E6A5818B82C1A38985437E3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 7 files
EXEbfe808e10d23b68f35b4e0e368c3ef25QuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 7swKOFhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host calehuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory 1WvgEMhuhuhuhuhuhuhu
InstallName NcFtjbhuhuhuhuhuhuhuhuhuhuhu
Install Onehuhuhuhu
Startup Drihuhuhuhu
Mutex 0huhuhuhu
StartupKey 0huhuhuhu
HideFile iCbBghuhuhuhuhuhuhu
EnableLogger Quasahuhuhuhuhuhuhu
Tag 1huhuhuhu
LogDirectory 1huhuhuhu
ServerSignature styhuhuhuhu
ServerCertificate Lhuhuhuhu
InstallPath 1huhuhuhu
LogsPath 1huhuhuhu
UnattendedMod 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void xClient.Program::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
1062
Main Method
System.Void xClient.Program::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void xClient.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean xClient.Config.Settings::Initialize()
brfalse.s IL_0040: call System.Void xClient.Program::Cleanup()
call System.Boolean xClient.Program::Initialize()
brfalse.s IL_0040: call System.Void xClient.Program::Cleanup()
call System.Boolean xClient.Core.Networking.QuasarClient::get_Exiting()
brtrue.s IL_0040: call System.Void xClient.Program::Cleanup()
ldsfld xClient.Core.Networking.QuasarClient xClient.Program::ConnectClient
callvirt System.Void xClient.Core.Networking.QuasarClient::Connect()
call System.Void xClient.Program::Cleanup()
call System.Void xClient.Program::Exit()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void xClient.Program::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
1062
Main Method
System.Void xClient.Program::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void xClient.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean xClient.Config.Settings::Initialize()
brfalse.s IL_0040: call System.Void xClient.Program::Cleanup()
call System.Boolean xClient.Program::Initialize()
brfalse.s IL_0040: call System.Void xClient.Program::Cleanup()
call System.Boolean xClient.Core.Networking.QuasarClient::get_Exiting()
brtrue.s IL_0040: call System.Void xClient.Program::Cleanup()
ldsfld xClient.Core.Networking.QuasarClient xClient.Program::ConnectClient
callvirt System.Void xClient.Core.Networking.QuasarClient::Connect()
call System.Void xClient.Program::Cleanup()
call System.Void xClient.Program::Exit()
ret <null>
CnC CNCmalicious
calehuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 7 files
EXEbfe808e10d23b68f35b4e0e368c3ef25QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 7swKOFhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host calehuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory 1WvgEMhuhuhuhuhuhuhu
InstallName NcFtjbhuhuhuhuhuhuhuhuhuhuhu
Install Onehuhuhuhu
Startup Drihuhuhuhu
Mutex 0huhuhuhu
StartupKey 0huhuhuhu
HideFile iCbBghuhuhuhuhuhuhu
EnableLogger Quasahuhuhuhuhuhuhu
Tag 1huhuhuhu
LogDirectory 1huhuhuhu
ServerSignature styhuhuhuhu
ServerCertificate Lhuhuhuhu
InstallPath 1huhuhuhu
LogsPath 1huhuhuhu
UnattendedMod 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
calehuhuhuhuhuhuhu
bfe808e10d23b68f35b4e0e368c3ef25
Port PORTmalicious
4huhuhuhu
bfe808e10d23b68f35b4e0e368c3ef25
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙