Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
646.66 KB · 646,656 B
First seen
2026-03-17 06:47 · 7 months ago
Last seen
2026-03-17 06:47 · 7 months ago
Last analysis
2026-03-17 06:48 · 7 months ago
Hashes
MD5 e835e628e0f8377badfed5cb7fc3e6b3 Sha1 c8b29f38ac1a121ef79b4eebd120ff76185eb04a Sha256 102b0010ff82572936b26dda6f3f9c13d61386f653c1759036b3d5258ad086ec Sha384 83f6b8d3bd922b47e7edd745ed012e4b940530775ca4f006339550234e65ced2f2dff5e3f6cc9918dd5431c57d5561c8 Sha512 ca3ca2633811a8eb84a5325a1b8b622223526ead38aa0b9adee04de921f5d60a9954d7ee4df7de84880fb1169311d8a9627f3def3f8a4b8ea038c6b8d18187f1 SSDeep 12288:EPRb90ASjkqjVnl36ud0zR/6CtQ9PUHIG8Dl8gSD+37PWY1Y1+f7LfNT2X3Yp/66:EJ9QjkqjVnlqud+/2P+AlUDcPt1aKFKs TLSH CED4022037FD8147E1BF6AB999F122006675F663A523EB4C1C4462BD4533781E9D23BA
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
High
1 malicious · 28 files
EXEe835e628e0f8377badfed5cb7fc3e6b3QuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINInvokedClient.InvokedClientApplication.resources
BINcostura.costura.dll.compressed
DLLcostura.costura.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.costura.pdb.compressed
PDBcostura.costura.pdb
BINcostura.gma.system.mousekeyhook.dll.compressed
DLLcostura.gma.system.mousekeyhook.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.newtonsoft.json.dll.compressed
DLLcostura.newtonsoft.json.dll
Structure
P7B[Authenticode]_220cad77.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.protobuf-net.dll.compressed
DLLcostura.protobuf-net.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.system.diagnostics.diagnosticsource.dll.compressed
DLLcostura.system.diagnostics.diagnosticsource.dll
Structure
P7B[Authenticode]_50c89911.p7b
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.invokedcommon.dll.compressed
DLLcostura.invokedcommon.dll
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINcostura.metadata
LISTILRepack.List
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version ziQvlThuhuhuhuhuhuhuhuhuhuhu
Port OwpPV7huhuhuhuhuhuhuhuhuhuhu
Host OwpPV7huhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key oovmzOhuhuhuhuhuhuhuhuhuhuhu
SubDirectory KapW/rhuhuhuhuhuhuhuhuhuhuhu
InstallName 1huhuhuhu
Install 1huhuhuhu
Startup 67Cywghuhuhuhuhuhuhuhuhuhuhu
Mutex /Ph+Fmhuhuhuhuhuhuhuhuhuhuhu
StartupKey 0huhuhuhu
HideFile 1huhuhuhu
EnableLogger D9FA0Ehuhuhuhuhuhuhuhuhuhuhu
EncryptionKey X1m+bqhuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client
Full Name
Client
EntryPoint
System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::Main()
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
613
Main Method
System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::Main()
Main IL Instruction Count
21
Main IL 
call System.Boolean ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::ᇜ飭늛䠲Ћ恀辢เ뭺溪䭝싑๮㽸⏧ￖ⩪釃̇()
pop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::�덬ⷲ探奨�㈰檱籐뺑홠帓ꎾ⫭栟큝卿⽶ᢌ(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::졺剠샫绤ﭪ偊胳㚊邰છ䐫궕㴺踰絵撕詷䝌(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 쇥衾㷅퐎톭鹁潛㢵渠䨋쫟�疞ெ綜᫕몈::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
Module Name
Client
Full Name
Client
EntryPoint
System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::Main()
Scope Name
Client
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
613
Main Method
System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::Main()
Main IL Instruction Count
21
Main IL 
call System.Boolean ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::ᇜ飭늛䠲Ћ恀辢เ뭺溪䭝싑๮㽸⏧ￖ⩪釃̇()
pop <null>
ldc.i4 3072
call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::�덬ⷲ探奨�㈰檱籐뺑홠帓ꎾ⫭栟큝卿⽶ᢌ(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ൄ茓卉昴ἦ῔ꓴಝꯖ╖㵊㭇钶ꦄ䥙⃓꘰࿠爺::졺剠샫绤ﭪ偊胳㚊邰છ䐫궕㴺踰絵撕詷䝌(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void 쇥衾㷅퐎톭鹁潛㢵渠䨋쫟�疞ெ綜᫕몈::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
CnC CNCmalicious
OwpPV7huhuhuhuhuhuhuhuhuhuhu
Port PORTmalicious
OwpPV7huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 28 files
EXEe835e628e0f8377badfed5cb7fc3e6b3QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version ziQvlThuhuhuhuhuhuhuhuhuhuhu
Port OwpPV7huhuhuhuhuhuhuhuhuhuhu
Host OwpPV7huhuhuhuhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key oovmzOhuhuhuhuhuhuhuhuhuhuhu
SubDirectory KapW/rhuhuhuhuhuhuhuhuhuhuhu
InstallName 1huhuhuhu
Install 1huhuhuhu
Startup 67Cywghuhuhuhuhuhuhuhuhuhuhu
Mutex /Ph+Fmhuhuhuhuhuhuhuhuhuhuhu
StartupKey 0huhuhuhu
HideFile 1huhuhuhu
EnableLogger D9FA0Ehuhuhuhuhuhuhuhuhuhuhu
EncryptionKey X1m+bqhuhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
OwpPV7huhuhuhuhuhuhuhuhuhuhu
e835e628e0f8377badfed5cb7fc3e6b3
Port PORTmalicious
OwpPV7huhuhuhuhuhuhuhuhuhuhu
e835e628e0f8377badfed5cb7fc3e6b3
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙