Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
1 malicious · 3 files
EXEe7147cdb6d659019ec2e453bb3a0ca72QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 2EA31Fhuhuhuhuhuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port mianofhuhuhuhuhuhuhu
Host mianofhuhuhuhuhuhuhu
Conf. AES-Key 2EA31Fhuhuhuhuhuhuhuhuhuhuhu
Version 1huhuhuhu
Port 8huhuhuhu
Host officehuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex a9a13ahuhuhuhuhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Eashuhuhuhu
LogDirectory Crahuhuhuhu
ServerSignature Ogwcvlhuhuhuhuhuhuhuhuhuhuhu
ServerCertificate MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 0huhuhuhu
UnattendedMod 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
1552
Main Method
System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::낽曨₌㻹鶰좔ೄ괃議轕뢥亻銹䢮᮶옾斎斊(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::Ꮯ릈௚⌅䞇酀鳓푬�ꛜꂫ蹭햛藍襓됦够￠(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 梄ᶋ늽ዀ싸쪙ᛢ㾏볇쟩啫甀�軇花ꥳ猁Ꮒ峐럄::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::Main(System.String[])
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.2
Total Strings
1552
Main Method
System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::Main(System.String[])
Main IL Instruction Count
19
Main IL 
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::낽曨₌㻹鶰좔ೄ괃議轕뢥亻銹䢮᮶옾斎斊(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 叄덨鐥꜐Ἅ뎺甲᷷폫婮諢ႁ鈇ษ扞螴ᦄ㘃ᚒ휠::Ꮯ릈௚⌅䞇酀鳓푬�ꛜꂫ蹭햛藍襓됦够￠(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 梄ᶋ늽ዀ싸쪙ᛢ㾏볇쟩啫甀�軇花ꥳ猁Ꮒ峐럄::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
officehuhuhuhuhuhuhu
Port PORTmalicious
8huhuhuhu
CnC CNCmalicious
mianofhuhuhuhuhuhuhu
Port PORTmalicious
mianofhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙