Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: d81ce1222bf1221f63d0a2593a325324
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
376.84 KB · 376,844 B
First seen
2025-11-23 00:02 · 11 months ago
Last seen
2025-11-23 00:02 · 11 months ago
Last analysis
2025-11-23 02:02 · 11 months ago
Hashes
MD5 d81ce1222bf1221f63d0a2593a325324 Sha1 a0afdafcbf8f2a7ab41ab59a4ad5150a96a519b1 Sha256 161f9da163d8e1572992702a3504958c155a80e0c5e585e15f612e49d9f0f361 Sha384 b8cb31f0fc6da7a41a9308b712c84fc10bcc85dba9171633f199208d07bd64c412779a7b10e8884908fbd5bfc08ed5e7 Sha512 66cd0119ddf1b384046d5612de8e4d9fb5e69436de27ea109d7e423bc45d83077d29e40437ba68877b51d05b2f5434fe0f73c9a76173baf8009f37baa7a2a0a4 SSDeep 6144:M+NHXf500Mr3rUO84+bBbpMMm7j6SyaGyIbK:7d501roDWF+wG/bK TLSH 89848D2373A8E93FD5BD2B3AE43206154BB1D4477B16E38B5A5855B82D133878E903B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXEd81ce1222bf1221f63d0a2593a325324QuasarRat
EXE[Rebuild from dump]_6369fc7b.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key zWf9gmhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host 192.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::쪝㎰쵬벑⑨툐藆ݷ䑡ꊸ椲綉耣᪺ꫜ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⽱٘㯹磌晥ꙮ㰭鶹ⵀᷧ㨸㺚≫鴥鏙㇘윾::헱ൻ诖愑됴䦬暣Ѩ狏�樭懔᧼讼磦ᡷ玤ﾣ()
brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
call System.Boolean ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::衽è롼腲戦与鱣ݫﵯ솑龩㲋멀訕̙ᇱ㖱底ˁ()
brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
call System.Boolean 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::get_Exiting()
brtrue.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
ldsfld 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::䃈鸞Ƚ蒞旚Ἓ㌅ᓬ楯魢萖᠄߼Ꭷ࿡᫞튫눪
callvirt System.Void 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::鸑அ㮡騟Ნ貾ꗄ퉝罬焲लꎏ똻ﰏ뿧�ԉ᠌()
call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::솋᧿껾ⴍꭳ꠼願ᵠʊ迦䎖睬﷉臁ꚪᢿ鉲ᘮ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::쪝㎰쵬벑⑨툐藆ݷ䑡ꊸ椲綉耣᪺ꫜ(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ⽱٘㯹磌晥ꙮ㰭鶹ⵀᷧ㨸㺚≫鴥鏙㇘윾::헱ൻ诖愑됴䦬暣Ѩ狏�樭懔᧼讼磦ᡷ玤ﾣ()
brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
call System.Boolean ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::衽è롼腲戦与鱣ݫﵯ솑龩㲋멀訕̙ᇱ㖱底ˁ()
brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
call System.Boolean 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::get_Exiting()
brtrue.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
ldsfld 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::䃈鸞Ƚ蒞旚Ἓ㌅ᓬ楯魢萖᠄߼Ꭷ࿡᫞튫눪
callvirt System.Void 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::鸑அ㮡騟Ნ貾ꗄ퉝罬焲लꎏ똻ﰏ뿧�ԉ᠌()
call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊()
call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::솋᧿껾ⴍꭳ꠼願ᵠʊ迦䎖睬﷉臁ꚪᢿ鉲ᘮ()
ret <null>
CnC CNCmalicious
192.huhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙