Malicious
d6ccd3234512a48cd1be709727833c2e
PE Executable
MD5: d6ccd3234512a48cd1be709727833c2e
Size: 11.57 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Size
11.57 MB · 11,574,080 B
First seen
2026-08-03 13:42 · 2 months ago
Last seen
2026-08-03 13:42 · 2 months ago
Last analysis
2026-08-03 13:42 · 2 months ago
Hashes
MD5
d6ccd3234512a48cd1be709727833c2e
Sha1
92179543b4aac52ad4a20e12cffe933977007986
Sha256
bb66148445c0402605f3090f0148c5845c9e83c5d73df3558c3967ba2de6b0cc
Sha384
6d6440d86af6cb846661e758f3df4fd7f7aea16c7fbfdb19067dd16a2344859303d14dc208b2613fbd81d4054ce3ad8a
Sha512
ba385846a08ed8a10d36d2e440937416e08916a67cd688661e9904e34b937ca207c64d550e7b86cad403504de0beb1bc1f3fbc783f55d5c1b64f60e762ef4c7b
SSDeep
24576:cOZTl7DdOhWuiFHoycG9WmkEl+jWm6DbHLsdTa4jliPFFFmGCmYTH/PsyY7dhg1m:4QwrJDk
TLSH
79C6328DE43A95D8DC4335F0BC82188C79495DE59FBD422A442CC46522FB6BD029BBFE
Detection
Symbol obfuscation
Medium
1 malicious · 11 files
EXEd6ccd3234512a48cd1be709727833c2eQuasarRat
Structure
P7B[Authenticode]_64941d51.p7b
BINResources
BINRT_MENU
BINID:0002
BINID:0
BINRT_MESSAGETABLE
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINQuasar.Client.Formularios.NT01.resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
pe:dll>pe:rsrc>bin
Shape
pe:dll>pe:rsrc>bin
malicious
3 nodes
Path
pe:dll>bin
Shape
pe:dll>bin
malicious
2 nodes
| Config. Field | Value |
|---|---|
| VERSION | 1.0huhuhuhu |
| RECONNECTDELAY | 5huhuhuhu |
| PASSWORD | 5EPmsqhuhuhuhuhuhuhuhuhuhuhu |
| SUBFOLDER | Shuhuhuhu |
| INSTALLNAME | INhuhuhuhu |
| INSTALL | 0huhuhuhu |
| STARTUP | 1huhuhuhu |
| MUTEX | e4d6a6huhuhuhuhuhuhuhuhuhuhu |
| STARTUPKEY | SThuhuhuhu |
| HIDEFILE | 1huhuhuhu |
| ENABLELOGGER | 1huhuhuhu |
| ENCRYPTIONKEY | O2CCRlhuhuhuhuhuhuhuhuhuhuhu |
| TAG | REhuhuhuhu |
| win7 | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Name | Value |
|---|---|
| Info | Authenticode present at 0xB07200 size 10560 bytes |
| Module Name | libfilezilla-43.dll |
| Full Name | libfilezilla-43.dll |
| Scope Name | libfilezilla-43.dll |
| Scope Type | ModuleDef |
| Kind | Dll |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | libfilezilla-43 |
| Assembly Version | 1.1.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.8 |
| Total Strings | 630 |
| Main Method | Not found or no body |
1 malicious · 11 files
EXEd6ccd3234512a48cd1be709727833c2eQuasarRat
Structure
P7B[Authenticode]_64941d51.p7b
BINResources
BIN.Net Resources
| Config. Field | Value |
|---|---|
| VERSION | 1.0huhuhuhu |
| RECONNECTDELAY | 5huhuhuhu |
| PASSWORD | 5EPmsqhuhuhuhuhuhuhuhuhuhuhu |
| SUBFOLDER | Shuhuhuhu |
| INSTALLNAME | INhuhuhuhu |
| INSTALL | 0huhuhuhu |
| STARTUP | 1huhuhuhu |
| MUTEX | e4d6a6huhuhuhuhuhuhuhuhuhuhu |
| STARTUPKEY | SThuhuhuhu |
| HIDEFILE | 1huhuhuhu |
| ENABLELOGGER | 1huhuhuhu |
| ENCRYPTIONKEY | O2CCRlhuhuhuhuhuhuhuhuhuhuhu |
| TAG | REhuhuhuhu |
| win7 | 0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account