Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Detection
PeID
Microsoft Visual C# / Basic .NET
1 malicious · 3 files
EXEf97fdacf16bf55444387179ef436f868QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key dwWhwJhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 161.huhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory michuhuhuhu
InstallName Updathuhuhuhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey servhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag M5 kahuhuhuhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::ຶ㷏柒麐ꐐᴴ鈧ᒷ枟䎄轏槰蠜嗔煸ﬢ�楶�헀(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 扣酙澨�偤灺员戝슱Έ觥鄉쭗誽끎蜭帟::胹鯰簵쿑ጧ쇠鴡ూ䟤윾픲︀봝ꥆᐤ()
brfalse.s IL_0040: call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
call System.Boolean 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::㓦뱠ꀄ샀쁰컻蠻୪ṱ픇ຝ⊿䐃니䖢膫㉒齯฿()
brfalse.s IL_0040: call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
call System.Boolean ⁓愄帧鞲妮⣘ퟜ銮縨为�睔葷칱엟贂Ͱ㤦娸::get_Exiting()
brtrue.s IL_0040: call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
ldsfld ⁓愄帧鞲妮⣘ퟜ銮縨为�睔葷칱엟贂Ͱ㤦娸 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::駽쮷糧⅐൞娢紥께籁ꐫ屖坌⓳ᛝ㡻뙨ᅓ❘ᑳ
callvirt System.Void ⁓愄帧鞲妮⣘ퟜ銮縨为�睔葷칱엟贂Ͱ㤦娸::尃�ﬣ嫼럄�㏩ᕛ焵ჯ몸㞰ힽ䔧綪뫷()
call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::�瀾색鹝甪ｍ扺彣즳愳愛떦轗䉶좡⾤瘈呏()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::ຶ㷏柒麐ꐐᴴ鈧ᒷ枟䎄轏槰蠜嗔煸ﬢ�楶�헀(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 扣酙澨�偤灺员戝슱Έ觥鄉쭗誽끎蜭帟::胹鯰簵쿑ጧ쇠鴡ూ䟤윾픲︀봝ꥆᐤ()
brfalse.s IL_0040: call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
call System.Boolean 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::㓦뱠ꀄ샀쁰컻蠻୪ṱ픇ຝ⊿䐃니䖢膫㉒齯฿()
brfalse.s IL_0040: call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
call System.Boolean ⁓愄帧鞲妮⣘ퟜ銮縨为�睔葷칱엟贂Ͱ㤦娸::get_Exiting()
brtrue.s IL_0040: call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
ldsfld ⁓愄帧鞲妮⣘ퟜ銮縨为�睔葷칱엟贂Ͱ㤦娸 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::駽쮷糧⅐൞娢紥께籁ꐫ屖坌⓳ᛝ㡻뙨ᅓ❘ᑳ
callvirt System.Void ⁓愄帧鞲妮⣘ퟜ銮縨为�睔葷칱엟贂Ͱ㤦娸::尃�ﬣ嫼럄�㏩ᕛ焵ჯ몸㞰ힽ䔧綪뫷()
call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::䎬뗜渓뇥뫆攘ሧ繫㏍͈⨴쑃㰱�雾쥫ꡉ蹐슩()
call System.Void 摂퉔椁톗ۮݢ䙠⵶犼좗圾궔괗㭀椘퓮萨煢::�瀾색鹝甪ｍ扺彣즳愳愛떦轗䉶좡⾤瘈呏()
ret <null>
CnC CNCmalicious
161.huhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙