Malicious
Malicious

d05e699b6c5340fd0bc35be8f3385c49

PE Executable
MD5: d05e699b6c5340fd0bc35be8f3385c49
Size: 2.26 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 2.2 MB PE Executable identified by Malva.RE as QuasarRat (rat). Static analysis extracted 107 embedded or derived files and a malware configuration (QuasarRAT config.). It matches 96 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9b151f4ffa47622d8b0823c33dfb2471af4b619f1ef6296fbdb9089c076d5abf
MD5
d05e699b6c5340fd0bc35be8f3385c49
Verdict
Malicious
File type
PE Executable · 2.2 MB
Family
QuasarRat
Category
RAT

Cite this report: https://app.malva.re/sha256/9b151f4ffa47622d8b0823c33dfb2471af4b619f1ef6296fbdb9089c076d5abf

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
HTML file
Size
2.26 MB · 2,255,360 B
First seen
2026-10-31 16:30 · 2 days ago
Last seen
2026-10-31 16:30 · 2 days ago
Last analysis
2026-10-31 16:30 · 2 days ago
Hashes
MD5 d05e699b6c5340fd0bc35be8f3385c49 Sha1 08ca7949817ca3254975490df52db653bfd82932 Sha256 9b151f4ffa47622d8b0823c33dfb2471af4b619f1ef6296fbdb9089c076d5abf Sha384 26b81797e2ae827e564906ddda1aec9a91e72e1f652220bc630a7b200c2b7cf092724df89d266dda8e1478d866489abb Sha512 de23ed21bcfaca4ea29e9be81cdee4a16fe0a41a29148293ee25b321a4f243b262609afe26284149de067a2c4772b5f46335dc77f4d8b95200d3ca385da69e28 SSDeep 49152:9+HbIRj7G7wRPirm2NnPTKKm77LrwCB6uanbECs:9+HbIToZNn2Km77LrwkFWbE TLSH C5A5F19173F8850BF1BF5BB5A83204591773B9429E7AD78E0888659D0EF37808E507AB
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

1 malicious · 107 files
EXEd05e699b6c5340fd0bc35be8f3385c49QuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINShadow.Client.FrmRemoteChat.resources
BINShadow.Client.Properties.Resources.resources
BINwlogo
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINcostura.aforge.dll.compressed
DLLcostura.aforge.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.aforge.video.dll.compressed
DLLcostura.aforge.video.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.aforge.video.directshow.dll.compressed
DLLcostura.aforge.video.directshow.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINAForge.Video.DirectShow.Properties.Resources.resources
BINcamera
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
BINAForge.Video.DirectShow.VideoCaptureDeviceForm.resources
BINcostura.gma.system.mousekeyhook.dll.compressed
DLLcostura.gma.system.mousekeyhook.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.naudio.core.dll.compressed
DLLcostura.naudio.core.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.naudio.wasapi.dll.compressed
DLLcostura.naudio.wasapi.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.naudio.winforms.dll.compressed
DLLcostura.naudio.winforms.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINNAudio.WinForms.Gui.PanSlider.resources
BIN$this.DefaultModifiers
BIN$this.GridSize
BIN$this.Language
BINNAudio.WinForms.Gui.VolumeSlider.resources
BINcostura.naudio.winmm.dll.compressed
DLLcostura.naudio.winmm.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.protobuf-net.dll.compressed
DLLcostura.protobuf-net.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.protobuf-net.core.dll.compressed
DLLcostura.protobuf-net.core.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.dll.compressed
DLLcostura.sharpdx.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.pdb.compressed
PDBcostura.sharpdx.pdb
BINcostura.sharpdx.d3dcompiler.dll.compressed
DLLcostura.sharpdx.d3dcompiler.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.d3dcompiler.pdb.compressed
PDBcostura.sharpdx.d3dcompiler.pdb
BINcostura.sharpdx.direct2d1.dll.compressed
DLLcostura.sharpdx.direct2d1.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.direct2d1.pdb.compressed
PDBcostura.sharpdx.direct2d1.pdb
BINcostura.sharpdx.direct3d11.dll.compressed
DLLcostura.sharpdx.direct3d11.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.direct3d11.pdb.compressed
PDBcostura.sharpdx.direct3d11.pdb
BINcostura.sharpdx.dxgi.dll.compressed
DLLcostura.sharpdx.dxgi.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.dxgi.pdb.compressed
PDBcostura.sharpdx.dxgi.pdb
BINcostura.sharpdx.mathematics.dll.compressed
DLLcostura.sharpdx.mathematics.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.sharpdx.mathematics.pdb.compressed
PDBcostura.sharpdx.mathematics.pdb
BINcostura.system.buffers.dll.compressed
DLLcostura.system.buffers.dll
Structure
P7B[Authenticode]_8c38879e.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Buffers.SR.resources
BINcostura.system.collections.immutable.dll.compressed
DLLcostura.system.collections.immutable.dll
Structure
P7B[Authenticode]_16f812e0.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Collections.Immutable.SR.resources
XMLILLink.Substitutions.xml
BINcostura.system.memory.dll.compressed
DLLcostura.system.memory.dll
Structure
P7B[Authenticode]_15ab3250.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Memory.SR.resources
BINcostura.system.numerics.vectors.dll.compressed
DLLcostura.system.numerics.vectors.dll
Structure
P7B[Authenticode]_ae030d4d.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BIN.Net Resources
BINFxResources.System.Numerics.Vectors.SR.resources
BINcostura.system.runtime.compilerservices.unsafe.dll.compressed
DLLcostura.system.runtime.compilerservices.unsafe.dll
Structure
P7B[Authenticode]_81de04f4.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.shadow.common.dll.compressed
DLLcostura.shadow.common.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.metadata
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
6 / 6
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:dll>bin
Shape pe:exe>pe:dll>bin
malicious 3 nodes

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile wyB6Dzhuhuhuhuhuhuhuhuhuhuhu
EnableLogger nWI4oVhuhuhuhuhuhuhuhuhuhuhu
EncryptionKey 3huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void mncxatgkocc.YAswLWwbZMBOYSu::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
2.7.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
3198
Info
PDB Path: ?
Main Method
System.Void mncxatgkocc.YAswLWwbZMBOYSu::Main(System.String[])
Main IL Instruction Count
13
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void mncxatgkocc.YAswLWwbZMBOYSu::KpO7QvdNzd01PhrFTTIQ()
call System.Void mncxatgkocc.YAswLWwbZMBOYSu::5bBTeioRsbfpoOM()
call System.Void mncxatgkocc.YAswLWwbZMBOYSu::Kmo0Ndj5jNkrt1xp5QOO()
newobj System.Void mncxatgkocc.oNKNmLlUMJ2HKG4Z7r5F::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void mncxatgkocc.YAswLWwbZMBOYSu::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
2.7.2.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
3198
Main Method
System.Void mncxatgkocc.YAswLWwbZMBOYSu::Main(System.String[])
Main IL Instruction Count
13
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void mncxatgkocc.YAswLWwbZMBOYSu::KpO7QvdNzd01PhrFTTIQ()
call System.Void mncxatgkocc.YAswLWwbZMBOYSu::5bBTeioRsbfpoOM()
call System.Void mncxatgkocc.YAswLWwbZMBOYSu::Kmo0Ndj5jNkrt1xp5QOO()
newobj System.Void mncxatgkocc.oNKNmLlUMJ2HKG4Z7r5F::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>

CnC CNCmalicious
Chainhuhuhuhuhuhuhu
Port PORTmalicious
Chainhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

1 malicious · 107 files
EXEd05e699b6c5340fd0bc35be8f3385c49QuasarRat
Structure

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version Objehuhuhuhu
Port Chainhuhuhuhuhuhuhu
Host Chainhuhuhuhuhuhuhu
ReconnectDelay Authhuhuhuhuhuhuhu
Key Chaihuhuhuhu
SubDirectory Keyhuhuhuhu
InstallName Ahuhuhuhu
Install Microshuhuhuhuhuhuhuhuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey -10huhuhuhu
HideFile wyB6Dzhuhuhuhuhuhuhuhuhuhuhu
EnableLogger nWI4oVhuhuhuhuhuhuhuhuhuhuhu
EncryptionKey 3huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

CnC CNCmalicious
Chainhuhuhuhuhuhuhu
d05e699b6c5340fd0bc35be8f3385c49
Port PORTmalicious
Chainhuhuhuhuhuhuhu
d05e699b6c5340fd0bc35be8f3385c49
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙