c6fa433638c26773708cb30d81b98aef

PE Executable

MD5: c6fa433638c26773708cb30d81b98aef

Size: 6.57 MB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

6.57 MB · 6,574,592 B

First seen

2026-09-08 13:45 · one month ago

Last seen

2026-09-08 13:45 · one month ago

Last analysis

2026-09-08 13:45 · one month ago

Hashes

MD5 c6fa433638c26773708cb30d81b98aef Sha1 1f45ca0c3e317b7483c031f95806d407a80faabb Sha256 46bdc54ed6ca8f9200d5445880c687d0e3730ec8adb9b5d57f420b951aa2be68 Sha384 84f307f0894ee0f226f4ac6ce7a2632cc5030b3d625a20dd23f6020b93ca57bd38a1f2d66bb696187c82231e89b36bc1 Sha512 dc11d66c56bd41230af244e167aab25cc8d4dba793838080a5d90321af18da7410b793c190194ff6ff9bd9fc1a16df3d27f574ba2f3cb739c236e4b6d9bf63bc SSDeep 196608:usSbk9fcCkbVN8iNIS8TkSIviB6tQJmUci4gFx:us2CkbXWkS0tQGiTb TLSH E26633194BD11D98EB7301399CB87041CAE5B662FD43DFEC4746220E48AABCF5A2B375

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 354 files

EXEc6fa433638c26773708cb30d81b98aefQuasarRat

Structure

BIN.Net Resources

BINcostura.aforge.dll.compressed

DLLcostura.aforge.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.aforge.video.dll.compressed

DLLcostura.aforge.video.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.anglesharp.dll.compressed

DLLcostura.anglesharp.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.bouncycastle.crypto.dll.compressed

DLLcostura.bouncycastle.crypto.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.costura.dll.compressed

DLLcostura.costura.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.costura.pdb.compressed

PDBcostura.costura.pdb

BINcostura.dk.standard.dll.compressed

DLLcostura.dk.standard.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.dk.wshruntime.dll.compressed

DLLcostura.dk.wshruntime.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.entityframework.dll.compressed

VBScostura.entityframework.dll

Structure

P7B[Authenticode]_0a9d005b.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINSystem.Data.Entity.Properties.Resources.resources

XSDSystem.Data.Resources.AnnotationSchema.xsd

XSDSystem.Data.Resources.CodeGenerationSchema.xsd

XSDSystem.Data.Resources.CSDLSchema_1.xsd

XSDSystem.Data.Resources.CSDLSchema_1_1.xsd

XSDSystem.Data.Resources.CSDLSchema_2.xsd

XSDSystem.Data.Resources.CSDLSchema_3.xsd

XSDSystem.Data.Resources.EntityStoreSchemaGenerator.xsd

XSDSystem.Data.Resources.SSDLSchema.xsd

XSDSystem.Data.Resources.SSDLSchema_2.xsd

XSDSystem.Data.Resources.SSDLSchema_3.xsd

XSDSystem.Data.Resources.CSMSL_1.xsd

XSDSystem.Data.Resources.CSMSL_2.xsd

XSDSystem.Data.Resources.CSMSL_3.xsd

XSDSystem.Data.Resources.ProviderServices.ProviderManifest.xsd

CSDLSystem.Data.Resources.DbProviderServices.ConceptualSchemaDefinition.csdl

CSDLSystem.Data.Resources.DbProviderServices.ConceptualSchemaDefinitionVersion3.csdl

BINcostura.entityframework.sqlserver.dll.compressed

DLLcostura.entityframework.sqlserver.dll

Structure

BIN.Net Resources

BINSystem.Data.Entity.SqlServer.Properties.Resources.SqlServer.resources

SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition.ssdl

SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3.ssdl

SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinitionVersion3_Sql8.ssdl

SSDLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaDefinition_Sql8.ssdl

MSLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMapping.msl

MSLSystem.Data.Resources.SqlClient.SqlProviderServices.StoreSchemaMappingVersion3.msl

XMLSystem.Data.Resources.SqlClient.SqlProviderServices.ProviderManifest.xml

P7B[Authenticode]_ab81b63c.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.microsoft.bcl.asyncinterfaces.dll.compressed

DLLcostura.microsoft.bcl.asyncinterfaces.dll

Structure

P7B[Authenticode]_75086844.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.microsoft.win32.primitives.dll.compressed

DLLcostura.microsoft.win32.primitives.dll

Structure

P7B[Authenticode]_ed258c28.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.microsoft.win32.registry.dll.compressed

DLLcostura.microsoft.win32.registry.dll

Structure

BIN.Net Resources

BINFxResources.Microsoft.Win32.Registry.SR.resources

P7B[Authenticode]_c8796d01.p7b

BINResources

BINIBC

BINID:0000

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.naudio.asio.dll.compressed

DLLcostura.naudio.asio.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.naudio.core.dll.compressed

DLLcostura.naudio.core.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.naudio.dll.compressed

DLLcostura.naudio.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.naudio.midi.dll.compressed

DLLcostura.naudio.midi.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.naudio.wasapi.dll.compressed

DLLcostura.naudio.wasapi.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.naudio.winforms.dll.compressed

DLLcostura.naudio.winforms.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINNAudio.WinForms.Gui.Fader.resources

BINNAudio.WinForms.Gui.PanSlider.resources

BIN$this.DefaultModifiers

BIN$this.GridSize

BIN$this.Language

BINNAudio.WinForms.Gui.VolumeSlider.resources

BINcostura.naudio.winmm.dll.compressed

DLLcostura.naudio.winmm.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.newtonsoft.json.dll.compressed

DLLcostura.newtonsoft.json.dll

Structure

P7B[Authenticode]_220cad77.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.reddelphin.dll.compressed

DLLcostura.reddelphin.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.reddelphin.pdb.compressed

PDBcostura.reddelphin.pdb

BINcostura.restsharp.dll.compressed

DLLcostura.restsharp.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.appcontext.dll.compressed

DLLcostura.system.appcontext.dll

Structure

P7B[Authenticode]_afab6e68.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.buffers.dll.compressed

DLLcostura.system.buffers.dll

Structure

P7B[Authenticode]_8c38879e.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Buffers.SR.resources

BINcostura.system.codedom.dll.compressed

DLLcostura.system.codedom.dll

Structure

P7B[Authenticode]_bce81f30.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.CodeDom.SR.resources

XMLILLink.Substitutions.xml

BINcostura.system.collections.immutable.dll.compressed

DLLcostura.system.collections.immutable.dll

Structure

P7B[Authenticode]_81e2fcc0.p7b

BINResources

BINIBC

BINID:0000

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Collections.Immutable.SR.resources

BINcostura.system.console.dll.compressed

DLLcostura.system.console.dll

Structure

P7B[Authenticode]_bb47301b.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Console.SR.resources

BINcostura.system.data.sqlite.dll.compressed

DLLcostura.system.data.sqlite.dll

Structure

P7B[Authenticode]_d3c9db45.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINSystem.Data.SQLite.SR.resources

BINsds-see-ekm.eeagle

BINsds-see-ekm.eeagle.b64sig

BMPSystem.Data.SQLite.Resources.SQLiteCommand.bmp

BMPSystem.Data.SQLite.Resources.SQLiteConnection.bmp

BMPSystem.Data.SQLite.Resources.SQLiteDataAdapter.bmp

BINcostura.system.data.sqlite.ef6.dll.compressed

DLLcostura.system.data.sqlite.ef6.dll

Structure

P7B[Authenticode]_4426c3d5.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINSystem.Data.SQLite.Properties.resources

SSDLSystem.Data.SQLite.SQLiteProviderServices.StoreSchemaDefinition.ssdl

CSDLSystem.Data.SQLite.Common.ConceptualSchemaDefinition.csdl

XMLSystem.Data.SQLite.SQLiteProviderServices.ProviderManifest.xml

MSLSystem.Data.SQLite.SQLiteProviderServices.StoreSchemaMapping.msl

BINcostura.system.data.sqlite.linq.dll.compressed

DLLcostura.system.data.sqlite.linq.dll

Structure

P7B[Authenticode]_55ebaddb.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

SSDLSystem.Data.SQLite.SQLiteProviderServices.StoreSchemaDefinition.ssdl

BINcostura.system.diagnostics.diagnosticsource.dll.compressed

DLLcostura.system.diagnostics.diagnosticsource.dll

Structure

P7B[Authenticode]_50c89911.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.diagnostics.tracing.dll.compressed

DLLcostura.system.diagnostics.tracing.dll

Structure

P7B[Authenticode]_096017f4.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Diagnostics.Tracing.SR.resources

BINcostura.system.drawing.common.dll.compressed

DLLcostura.system.drawing.common.dll

Structure

P7B[Authenticode]_a1e7a003.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Drawing.Common.SR.resources

BINcostura.system.drawing.common.pdb.compressed

PDBcostura.system.drawing.common.pdb

BINcostura.system.drawing.primitives.dll.compressed

DLLcostura.system.drawing.primitives.dll

Structure

P7B[Authenticode]_4bd5d17c.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.globalization.calendars.dll.compressed

DLLcostura.system.globalization.calendars.dll

Structure

P7B[Authenticode]_9327ba71.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.io.compression.dll.compressed

DLLcostura.system.io.compression.dll

Structure

P7B[Authenticode]_3524107a.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.IO.Compression.SR.resources

BINcostura.system.io.compression.zipfile.dll.compressed

DLLcostura.system.io.compression.zipfile.dll

Structure

P7B[Authenticode]_e81f3405.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.IO.Compression.ZipFile.SR.resources

BINcostura.system.io.dll.compressed

DLLcostura.system.io.dll

Structure

P7B[Authenticode]_fe2eb4e9.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.io.filesystem.dll.compressed

DLLcostura.system.io.filesystem.dll

Structure

P7B[Authenticode]_fd10d60f.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.io.filesystem.primitives.dll.compressed

DLLcostura.system.io.filesystem.primitives.dll

Structure

P7B[Authenticode]_fc5ae0db.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.linq.async.dll.compressed

DLLcostura.system.linq.async.dll

Structure

P7B[Authenticode]_6ca048dc.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.linq.dll.compressed

DLLcostura.system.linq.dll

Structure

P7B[Authenticode]_414fcd59.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Linq.SR.resources

BINcostura.system.linq.expressions.dll.compressed

DLLcostura.system.linq.expressions.dll

Structure

P7B[Authenticode]_2f2632a5.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.memory.dll.compressed

DLLcostura.system.memory.dll

Structure

P7B[Authenticode]_15ab3250.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Memory.SR.resources

BINcostura.system.net.http.dll.compressed

DLLcostura.system.net.http.dll

Structure

P7B[Authenticode]_e58922d7.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Net.Http.SR.resources

BINcostura.system.net.sockets.dll.compressed

DLLcostura.system.net.sockets.dll

Structure

P7B[Authenticode]_87749caa.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Net.Sockets.SR.resources

BINcostura.system.numerics.vectors.dll.compressed

DLLcostura.system.numerics.vectors.dll

Structure

BIN.Net Resources

BINFxResources.System.Numerics.Vectors.SR.resources

P7B[Authenticode]_ae030d4d.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.reflection.dll.compressed

DLLcostura.system.reflection.dll

Structure

P7B[Authenticode]_bc4d7617.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.runtime.compilerservices.unsafe.dll.compressed

DLLcostura.system.runtime.compilerservices.unsafe.dll

Structure

P7B[Authenticode]_81de04f4.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.runtime.dll.compressed

DLLcostura.system.runtime.dll

Structure

P7B[Authenticode]_81778357.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.runtime.extensions.dll.compressed

DLLcostura.system.runtime.extensions.dll

Structure

P7B[Authenticode]_7fbf9f0f.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Runtime.Extensions.SR.resources

BINcostura.system.runtime.interopservices.dll.compressed

DLLcostura.system.runtime.interopservices.dll

Structure

P7B[Authenticode]_e0353a4e.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.runtime.interopservices.runtimeinformation.dll.compressed

DLLcostura.system.runtime.interopservices.runtimeinformation.dll

Structure

BIN.Net Resources

BINFxResources.System.Runtime.InteropServices.RuntimeInformation.SR.resources

P7B[Authenticode]_2cfabfa2.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.security.accesscontrol.dll.compressed

DLLcostura.system.security.accesscontrol.dll

Structure

P7B[Authenticode]_d262bb6d.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Security.AccessControl.SR.resources

BINcostura.system.security.cryptography.algorithms.dll.compressed

DLLcostura.system.security.cryptography.algorithms.dll

Structure

P7B[Authenticode]_d1d7a991.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Security.Cryptography.Algorithms.SR.resources

BINcostura.system.security.cryptography.encoding.dll.compressed

DLLcostura.system.security.cryptography.encoding.dll

Structure

P7B[Authenticode]_640c135d.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.security.cryptography.primitives.dll.compressed

DLLcostura.system.security.cryptography.primitives.dll

Structure

P7B[Authenticode]_bb12d671.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.security.cryptography.protecteddata.dll.compressed

DLLcostura.system.security.cryptography.protecteddata.dll

Structure

P7B[Authenticode]_c2230b96.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.security.cryptography.x509certificates.dll.compressed

DLLcostura.system.security.cryptography.x509certificates.dll

Structure

P7B[Authenticode]_a7c213b8.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Security.Cryptography.X509Certificates.SR.resources

BINcostura.system.security.principal.windows.dll.compressed

DLLcostura.system.security.principal.windows.dll

Structure

P7B[Authenticode]_20569987.p7b

BINResources

BINIBC

BINID:0000

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

XMLSystem.Security.Principal.Windows.xml

BINcostura.system.text.encoding.codepages.dll.compressed

DLLcostura.system.text.encoding.codepages.dll

Structure

P7B[Authenticode]_497f0204.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Text.Encoding.CodePages.SR.resources

NLPcodepages.nlp

XMLILLink.Substitutions.xml

BINcostura.system.text.encodings.web.dll.compressed

DLLcostura.system.text.encodings.web.dll

Structure

P7B[Authenticode]_06fd6b5d.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Text.Encodings.Web.SR.resources

XMLILLink.Substitutions.xml

BINcostura.system.text.json.dll.compressed

DLLcostura.system.text.json.dll

Structure

P7B[Authenticode]_0d06e0c1.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Text.Json.SR.resources

XMLILLink.Substitutions.xml

BINcostura.system.text.regularexpressions.dll.compressed

DLLcostura.system.text.regularexpressions.dll

Structure

P7B[Authenticode]_db16f76c.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.threading.channels.dll.compressed

DLLcostura.system.threading.channels.dll

Structure

P7B[Authenticode]_157726f1.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Threading.Channels.SR.resources

BINcostura.system.threading.tasks.dataflow.dll.compressed

DLLcostura.system.threading.tasks.dataflow.dll

Structure

P7B[Authenticode]_26b60d1e.p7b

BINResources

BINIBC

BINID:0000

BINID:0

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.Threading.Tasks.Dataflow.SR.resources

BINcostura.system.threading.tasks.extensions.dll.compressed

DLLcostura.system.threading.tasks.extensions.dll

Structure

P7B[Authenticode]_7121b905.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.system.valuetuple.dll.compressed

DLLcostura.system.valuetuple.dll

Structure

P7B[Authenticode]_5e4e41f0.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BIN.Net Resources

BINFxResources.System.ValueTuple.SR.resources

BINcostura.system.xml.readerwriter.dll.compressed

DLLcostura.system.xml.readerwriter.dll

Structure

P7B[Authenticode]_924ce2af.p7b

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.websocket-sharp.dll.compressed

DLLcostura.websocket-sharp.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.youtubeexplode.dll.compressed

DLLcostura.youtubeexplode.dll

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINcostura.metadata

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path pe:exe>pe:dll>pe:rsrc>bin

Shape pe:exe>pe:dll>pe:rsrc>bin

malicious 4 nodes

Path pe:exe>pe:dll>bin

Shape pe:exe>pe:dll>bin

malicious 3 nodes

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version	Objehuhuhuhu
Port	Chainhuhuhuhuhuhuhu
Host	Chainhuhuhuhuhuhuhu
ReconnectDelay	Authhuhuhuhuhuhuhu
Key	Chaihuhuhuhu
SubDirectory	Keyhuhuhuhu
InstallName	Ahuhuhuhu
Install	Microshuhuhuhuhuhuhuhuhuhuhu
Startup	1huhuhuhu
Mutex	1huhuhuhu
StartupKey	-10huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	RedDolphinClient.exe
Full Name	RedDolphinClient.exe
EntryPoint	System.Void RedDolphinClient.Program::<Main>(System.String[])
Scope Name	RedDolphinClient.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	RedDolphinClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	419
Main Method	System.Void RedDolphinClient.Program::<Main>(System.String[])
Main IL Instruction Count	7
Main IL	`ldarg.0 <null> call System.Threading.Tasks.Task RedDolphinClient.Program::Main(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>`
Info	`PDB Path: /Users/djhiphouse/RiderProjects/RedDelphin/RedDolphinClient/obj/Release/RedDolphinClient.pdb`
Module Name	RedDolphinClient.exe
Full Name	RedDolphinClient.exe
EntryPoint	System.Void RedDolphinClient.Program::<Main>(System.String[])
Scope Name	RedDolphinClient.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	RedDolphinClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	419
Main Method	System.Void RedDolphinClient.Program::<Main>(System.String[])
Main IL Instruction Count	7
Main IL	`ldarg.0 <null> call System.Threading.Tasks.Task RedDolphinClient.Program::Main(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>`

CnC CNCmalicious

Chainhuhuhuhuhuhuhu

Port PORTmalicious

Chainhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

1 malicious · 354 files

EXEc6fa433638c26773708cb30d81b98aefQuasarRat

Structure

BIN.Net Resources

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version	Objehuhuhuhu
Port	Chainhuhuhuhuhuhuhu
Host	Chainhuhuhuhuhuhuhu
ReconnectDelay	Authhuhuhuhuhuhuhu
Key	Chaihuhuhuhu
SubDirectory	Keyhuhuhuhu
InstallName	Ahuhuhuhu
Install	Microshuhuhuhuhuhuhuhuhuhuhu
Startup	1huhuhuhu
Mutex	1huhuhuhu
StartupKey	-10huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

CnC CNCmalicious

Chainhuhuhuhuhuhuhu

c6fa433638c26773708cb30d81b98aef

Port PORTmalicious

Chainhuhuhuhuhuhuhu

c6fa433638c26773708cb30d81b98aef

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential