Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 5 files
EXEd2ebd4669742c3eca630f806cbf56930QuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key Whxbgthuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port anydehuhuhuhuhuhuhu
Host anydehuhuhuhuhuhuhu
Conf. AES-Key Whxbgthuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 2huhuhuhu
Host 154.huhuhuhuhuhuhu
Conf. AES-Key Whxbgthuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 2huhuhuhu
Host 5.18huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory dehuhuhuhu
InstallName deshuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey dehuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag michuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::뎖Ꞥ햏ঁﯫ៶Ị∂穯걉兝ⲩ뗕燴㢷渆慚꭫ₗ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⌤捤喢䧍巡婘颦伜ፙ訫ⓩ古혇齭�㘻ᇪ▸莟::麫촘ꔔ颀坒춐픭꡴෭䛅㽩≤ौ氕减ﮞ렗媴회()
brfalse.s IL_0040: call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
call System.Boolean ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::曀碲퍿ϊၐ䶑⠮邧⠃駀᱆�こ▄뵰㖳()
brfalse.s IL_0040: call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
call System.Boolean 諄㨠巚䇊㯄羸齶零鈊㢥㚰쇋ᶊ뱓遶쟜軷::get_Exiting()
brtrue.s IL_0040: call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
ldsfld 諄㨠巚䇊㯄羸齶零鈊㢥㚰쇋ᶊ뱓遶쟜軷 ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::᤭鱝지ᡗ꜖�뛦淞孠틄㢄㎰女ꈈ쥓ꍑ囿
callvirt System.Void 諄㨠巚䇊㯄羸齶零鈊㢥㚰쇋ᶊ뱓遶쟜軷::퍢鴂徲᫪㫃ᴺ欞紜ᘔ㮪皿婌᜻ʼ趾蕮赐៧Ꞷ卹()
call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::㆟躂ᨪ㷤嬛랖䜾耉婁᧷่흯韘잛ꍑ召䊊햲ԇ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::뎖Ꞥ햏ঁﯫ៶Ị∂穯걉兝ⲩ뗕燴㢷渆慚꭫ₗ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⌤捤喢䧍巡婘颦伜ፙ訫ⓩ古혇齭�㘻ᇪ▸莟::麫촘ꔔ颀坒춐픭꡴෭䛅㽩≤ौ氕减ﮞ렗媴회()
brfalse.s IL_0040: call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
call System.Boolean ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::曀碲퍿ϊၐ䶑⠮邧⠃駀᱆�こ▄뵰㖳()
brfalse.s IL_0040: call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
call System.Boolean 諄㨠巚䇊㯄羸齶零鈊㢥㚰쇋ᶊ뱓遶쟜軷::get_Exiting()
brtrue.s IL_0040: call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
ldsfld 諄㨠巚䇊㯄羸齶零鈊㢥㚰쇋ᶊ뱓遶쟜軷 ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::᤭鱝지ᡗ꜖�뛦淞孠틄㢄㎰女ꈈ쥓ꍑ囿
callvirt System.Void 諄㨠巚䇊㯄羸齶零鈊㢥㚰쇋ᶊ뱓遶쟜軷::퍢鴂徲᫪㫃ᴺ欞紜ᘔ㮪皿婌᜻ʼ趾蕮赐៧Ꞷ卹()
call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::媎왝躰䘘⾗䰴ዷ�ƣ蔈瀌�苹͟숱۹㙼()
call System.Void ꅊ﮶䡺宺㯳暀娓븰馚䪋찞딃ꄩ�璲ᓾ鍌䟈::㆟躂ᨪ㷤嬛랖䜾耉婁᧷่흯韘잛ꍑ召䊊햲ԇ()
ret <null>
CnC CNCmalicious
5.18huhuhuhuhuhuhu
Port PORTmalicious
2huhuhuhu
CnC CNCmalicious
154.huhuhuhuhuhuhu
CnC CNCmalicious
anydehuhuhuhuhuhuhu
Port PORTmalicious
anydehuhuhuhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙