Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXEc91c07e5d50a384a160a95f405ce31cfQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key Ekoy7zhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port kamalhuhuhuhuhuhuhu
Host kamalhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory vhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag vhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::擢貐욜鱳培䗥㆒䥠ᇛ刁篲诇荜쟒مᜇ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 蒺疒�뒷鴷᰸⩐㚐酀ᅶꠁ㕝ᴜ䝷磍忡醶㽟䘜::缸늒炈첏쭛늷튙�ᙾ셀泜큙ﶅ꺮࿈�賲隌㞳()
brfalse.s IL_0040: call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
call System.Boolean 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::閧ᗈფᛳ炀⇔⨞睃咝暰꞉瑪㑣琲()
brfalse.s IL_0040: call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
call System.Boolean 慟㊹ꉌ薗鏸쩅ꊅ꤃ 㗊䞪ᘠ⵺ꌣ䉤婚褫쁶쎡::get_Exiting()
brtrue.s IL_0040: call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
ldsfld 慟㊹ꉌ薗鏸쩅ꊅ꤃ 㗊䞪ᘠ⵺ꌣ䉤婚褫쁶쎡 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::攖ﶬ乷鳇韎弝Ȋ⏇厘凲㹟ⵦ덁䉲畸깚阂脵爆軯
callvirt System.Void 慟㊹ꉌ薗鏸쩅ꊅ꤃ 㗊䞪ᘠ⵺ꌣ䉤婚褫쁶쎡::�ᒟ峌ᘛꖋ戲粫ᗯ쎙઻町俛葲㧫婓道Ꮥ()
call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::䍌ဓꉮॺ㹑ԟ狺┻瓷젹밧洍죅悽뒓⡂ᨫ컃()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::擢貐욜鱳培䗥㆒䥠ᇛ刁篲诇荜쟒مᜇ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 蒺疒�뒷鴷᰸⩐㚐酀ᅶꠁ㕝ᴜ䝷磍忡醶㽟䘜::缸늒炈첏쭛늷튙�ᙾ셀泜큙ﶅ꺮࿈�賲隌㞳()
brfalse.s IL_0040: call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
call System.Boolean 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::閧ᗈფᛳ炀⇔⨞睃咝暰꞉瑪㑣琲()
brfalse.s IL_0040: call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
call System.Boolean 慟㊹ꉌ薗鏸쩅ꊅ꤃ 㗊䞪ᘠ⵺ꌣ䉤婚褫쁶쎡::get_Exiting()
brtrue.s IL_0040: call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
ldsfld 慟㊹ꉌ薗鏸쩅ꊅ꤃ 㗊䞪ᘠ⵺ꌣ䉤婚褫쁶쎡 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::攖ﶬ乷鳇韎弝Ȋ⏇厘凲㹟ⵦ덁䉲畸깚阂脵爆軯
callvirt System.Void 慟㊹ꉌ薗鏸쩅ꊅ꤃ 㗊䞪ᘠ⵺ꌣ䉤婚褫쁶쎡::�ᒟ峌ᘛꖋ戲粫ᗯ쎙઻町俛葲㧫婓道Ꮥ()
call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::ᩌ侵᱐骩�짪⹂᳅悵䵿휪欻䉲ꛄ떮矗욆()
call System.Void 㖓䫼换찄싏梍荤浕湊�䵡蝼⋥Ὴ纬::䍌ဓꉮॺ㹑ԟ狺┻瓷젹밧洍죅悽뒓⡂ᨫ컃()
ret <null>
CnC CNCmalicious
kamalhuhuhuhuhuhuhu
Port PORTmalicious
kamalhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙