Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
2 malicious · 6 files
EXEf50bb1d2f5798fe19062aff489c02d91QuasarRat
EXE[Rebuild from dump]_a2775d70.exeQuasarRat
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key xhKpsghuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port mhuhuhuhu
Host mhuhuhuhu
Conf. AES-Key xhKpsghuhuhuhuhuhuhu
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port 4huhuhuhu
Host misov.huhuhuhuhuhuhu
Conf. AES-Key xhKpsghuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host 125.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key L+HIjNhuhuhuhuhuhuhu
AuthKey Kr+FEDhuhuhuhuhuhuhuhuhuhuhu
InstallName mainthuhuhuhuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey maihuhuhuhu
HideFile 1huhuhuhu
EnableLogger 0huhuhuhu
Tag bhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::⫑썘圻�잖뻐ᤆ⹣�䚗괺櫇奦籖筏괗එ鑆큁(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 挽ڈ✡黂ᢕ애ꗴ鑮䷧�軙戨ꓝ삦콊鴶�㢹::湘芔꟝깎ᇧ烥휍뻐堒癕闓꾮㝎킙麉㻠ﴇ()
brfalse.s IL_0040: call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
call System.Boolean ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::અ�禀䙐뎘憼렌퐉ᆝ녯쵰鹥拐팲婢䪽()
brfalse.s IL_0040: call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
call System.Boolean 䠀盠�귆佤峯툟滂꭫婲챰兄쭇鋜釳鹠奖::get_Exiting()
brtrue.s IL_0040: call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
ldsfld 䠀盠�귆佤峯툟滂꭫婲챰兄쭇鋜釳鹠奖 ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::稹볷풝侠缧墳旭믑䈃惤�趦똯ѝ꫸ẝ밫㢏늛鹂
callvirt System.Void 䠀盠�귆佤峯툟滂꭫婲챰兄쭇鋜釳鹠奖::ᵄ♹鹚᥈ⴗ骟݀撥邨⟩➠閑瞨᭢첬驝쇵()
call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::枥뷎웢枏풰㮏㿱�霬ௌࣿ䴡恴魞벿嚾ꝕᤇ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::⫑썘圻�잖뻐ᤆ⹣�䚗괺櫇奦籖筏괗එ鑆큁(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 挽ڈ✡黂ᢕ애ꗴ鑮䷧�軙戨ꓝ삦콊鴶�㢹::湘芔꟝깎ᇧ烥휍뻐堒癕闓꾮㝎킙麉㻠ﴇ()
brfalse.s IL_0040: call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
call System.Boolean ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::અ�禀䙐뎘憼렌퐉ᆝ녯쵰鹥拐팲婢䪽()
brfalse.s IL_0040: call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
call System.Boolean 䠀盠�귆佤峯툟滂꭫婲챰兄쭇鋜釳鹠奖::get_Exiting()
brtrue.s IL_0040: call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
ldsfld 䠀盠�귆佤峯툟滂꭫婲챰兄쭇鋜釳鹠奖 ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::稹볷풝侠缧墳旭믑䈃惤�趦똯ѝ꫸ẝ밫㢏늛鹂
callvirt System.Void 䠀盠�귆佤峯툟滂꭫婲챰兄쭇鋜釳鹠奖::ᵄ♹鹚᥈ⴗ骟݀撥邨⟩➠閑瞨᭢첬驝쇵()
call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::莚㌹⿌꫌Ǝ⸰䆥炙赙걎낭뜁ᬟᠿ鱒閹⒯蛡()
call System.Void ﻵ兀ᖻ�寪뀑邂ូ宱乢挈佫氟蛞쯻ꮖﭪ䵣银᝕::枥뷎웢枏풰㮏㿱�霬ௌࣿ䴡恴魞벿嚾ꝕᤇ()
ret <null>
CnC CNCmalicious
125.1huhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
CnC CNCmalicious
misov.huhuhuhuhuhuhu
CnC CNCmalicious
mhuhuhuhu
Port PORTmalicious
mhuhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙