Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXEe1647b0085457211e4b9e887c807e21cQuasarRat
EXE[Rebuild from dump]_0474f309.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key mILR4Whuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port tohuhuhuhu
Host tohuhuhuhu
Conf. AES-Key mILR4Whuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host toptohuhuhuhuhuhuhu
Conf. AES-Key mILR4Whuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host 37.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ahuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::೅湟랒Ⱥ킢ꮪȡ㐨ሏ説ᾈ뷺砖᯼쪒蒸걾や(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 쁭린�孈꛴ք㢬쮄ꖥ쪰吳鉵蔳锰퐉佱嚂糎::ٞ띻퍖䎸톶᳢᷎�櫋殫蠦䯳儽�ߴ栎虆ܼኯ()
brfalse.s IL_0040: call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
call System.Boolean �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::薐낒ۄ쁞㱴譚챖ꁥ⽂㡫䕫쭸踊ၙ좝圬ꃸ華()
brfalse.s IL_0040: call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
call System.Boolean ᑢﾮ敎超缆徤逿΢‴ꛆ⬔睮栆䀕쉱뙼觃::get_Exiting()
brtrue.s IL_0040: call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
ldsfld ᑢﾮ敎超缆徤逿΢‴ꛆ⬔睮栆䀕쉱뙼觃 �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::⯜ᠫﳌ녃͘∛卾跰횼澋㜝撝ꈖ푈믐㜛⇾
callvirt System.Void ᑢﾮ敎超缆徤逿΢‴ꛆ⬔睮栆䀕쉱뙼觃::ᷗ쳵䯯閽칙덦�ꮳⵕ⑩擮醱㉾ᎍ�猞ﴱ鈛矺()
call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::㚮ꃪࠎꏧ␅䗊囘�펾뛭퉣夿૟曬締㗥敃၄뎙()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::೅湟랒Ⱥ킢ꮪȡ㐨ሏ説ᾈ뷺砖᯼쪒蒸걾や(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 쁭린�孈꛴ք㢬쮄ꖥ쪰吳鉵蔳锰퐉佱嚂糎::ٞ띻퍖䎸톶᳢᷎�櫋殫蠦䯳儽�ߴ栎虆ܼኯ()
brfalse.s IL_0040: call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
call System.Boolean �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::薐낒ۄ쁞㱴譚챖ꁥ⽂㡫䕫쭸踊ၙ좝圬ꃸ華()
brfalse.s IL_0040: call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
call System.Boolean ᑢﾮ敎超缆徤逿΢‴ꛆ⬔睮栆䀕쉱뙼觃::get_Exiting()
brtrue.s IL_0040: call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
ldsfld ᑢﾮ敎超缆徤逿΢‴ꛆ⬔睮栆䀕쉱뙼觃 �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::⯜ᠫﳌ녃͘∛卾跰횼澋㜝撝ꈖ푈믐㜛⇾
callvirt System.Void ᑢﾮ敎超缆徤逿΢‴ꛆ⬔睮栆䀕쉱뙼觃::ᷗ쳵䯯閽칙덦�ꮳⵕ⑩擮醱㉾ᎍ�猞ﴱ鈛矺()
call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::盙疛䟇侕⽣趤鎻㟽滤אַ᜷眴ﳷⳌ()
call System.Void �嘊쵆�錟빲윌檴꜆紝밢䭍ᠯ폏觥牭盞櫩赏::㚮ꃪࠎꏧ␅䗊囘�펾뛭퉣夿૟曬締㗥敃၄뎙()
ret <null>
CnC CNCmalicious
37.1huhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
toptohuhuhuhuhuhuhu
CnC CNCmalicious
tohuhuhuhu
Port PORTmalicious
tohuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙