Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
High
1 malicious · 21 files
EXEd550efcce73258ec2d4abbb5b6ac8a99QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key T6CEZOhuhuhuhuhuhuhu
Version 2.huhuhuhu
Port 4huhuhuhu
Host 127huhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
SubDirectory NcFtjbhuhuhuhuhuhuhuhuhuhuhu
InstallName Suhuhuhuhu
Install Clihuhuhuhu
Startup 1huhuhuhu
Mutex 1huhuhuhu
StartupKey VNM_Mhuhuhuhuhuhuhu
HideFile Venomhuhuhuhuhuhuhu
EnableLogger 0huhuhuhu
EncryptionKey 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
$77-Venom.exe
Full Name
$77-Venom.exe
EntryPoint
System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::Main(System.String[])
Scope Name
$77-Venom.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
$77-Venom
Assembly Version
2.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
2085
Main Method
System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::Main(System.String[])
Main IL Instruction Count
21
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::犔ᆃᆸ⣴᪹蕼熥跜뻄Ⓨ恜뿳ᖗ칃栕瀉뿶Ҫ몡(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ջ㝱錔穔觘�ç㫑츹ﲆꇞ벟ᶎ渇擜䶚鯥寫::輋﷫苲捳댶衖ﳿ處ꕊ锂ꃈÛ⇜茹첟抩᏾莇()
brfalse.s IL_0040: call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
call System.Boolean 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::魁費䏠㻁暈ٜ⤘咇䕇杅꿅妶軒폩琡﹘㕫હ밂()
brfalse.s IL_0040: call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
call System.Boolean 斤䳢ت漞ᥔ䞓ﳳ풬ਸ਼꼢⒐⑊顥㘴곹鍯젛ᚡ鯾::get_Exiting()
brtrue.s IL_0040: call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
ldsfld 斤䳢ت漞ᥔ䞓ﳳ풬ਸ਼꼢⒐⑊顥㘴곹鍯젛ᚡ鯾 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::辈㳷é᩿䟞骦懕儐﷈ࡐḷ咠帡Š팳꿑罹
callvirt System.Void 斤䳢ت漞ᥔ䞓ﳳ풬ਸ਼꼢⒐⑊顥㘴곹鍯젛ᚡ鯾::�鬧꿔흒ᩣ㓯ᆋƣꮉ촾풋�뺲DZ㓴햿꜉⁀۶()
call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
call System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::�৽ʮ筗㺏펶ྗ聉큮㑠꽿洪阔ႄ糅豂㙷ꇄ⤚()
call System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::훇菳쑆묘泍呧魯㢧ᧇ첳ѧ慥穠쐰齷촬嶺裸㝓�()
call System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::퐱路�㸖勞䳛鰣䶗何瘛좸㚤ᔟ뛙項ꖆ䘇䱄땀()
ret <null>
Module Name
$77-Venom.exe
Full Name
$77-Venom.exe
EntryPoint
System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::Main(System.String[])
Scope Name
$77-Venom.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
$77-Venom
Assembly Version
2.1.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
2085
Main Method
System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::Main(System.String[])
Main IL Instruction Count
21
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::犔ᆃᆸ⣴᪹蕼熥跜뻄Ⓨ恜뿳ᖗ칃栕瀉뿶Ҫ몡(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ջ㝱錔穔觘�ç㫑츹ﲆꇞ벟ᶎ渇擜䶚鯥寫::輋﷫苲捳댶衖ﳿ處ꕊ锂ꃈÛ⇜茹첟抩᏾莇()
brfalse.s IL_0040: call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
call System.Boolean 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::魁費䏠㻁暈ٜ⤘咇䕇杅꿅妶軒폩琡﹘㕫હ밂()
brfalse.s IL_0040: call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
call System.Boolean 斤䳢ت漞ᥔ䞓ﳳ풬ਸ਼꼢⒐⑊顥㘴곹鍯젛ᚡ鯾::get_Exiting()
brtrue.s IL_0040: call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
ldsfld 斤䳢ت漞ᥔ䞓ﳳ풬ਸ਼꼢⒐⑊顥㘴곹鍯젛ᚡ鯾 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::辈㳷é᩿䟞骦懕儐﷈ࡐḷ咠帡Š팳꿑罹
callvirt System.Void 斤䳢ت漞ᥔ䞓ﳳ풬ਸ਼꼢⒐⑊顥㘴곹鍯젛ᚡ鯾::�鬧꿔흒ᩣ㓯ᆋƣꮉ촾풋�뺲DZ㓴햿꜉⁀۶()
call System.Void ᅇ呫緤슦灕㞔㶚蓤䮤뒸歞晷ﭓﳠፍ漃䒽죿鬖::鶜鲰彲ﱎ仗ʌ㌞훪�릨瓚잸⧪麒碴瞄ᡔ()
call System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::�৽ʮ筗㺏펶ྗ聉큮㑠꽿洪阔ႄ糅豂㙷ꇄ⤚()
call System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::훇菳쑆묘泍呧魯㢧ᧇ첳ѧ慥穠쐰齷촬嶺裸㝓�()
call System.Void 草왃棽㜢톍蔏ꖘ롅횈氁빗᙭�䢸阆∄六㕺::퐱路�㸖勞䳛鰣䶗何瘛좸㚤ᔟ뛙項ꖆ䘇䱄땀()
ret <null>
CnC CNCmalicious
127huhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙