Malicious
Malicious

fbd156c750e6d53e2d7fd89c74cd3830

PE Executable
MD5: fbd156c750e6d53e2d7fd89c74cd3830
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
356.35 KB · 356,352 B
First seen
2025-11-23 01:03 · 11 months ago
Last seen
2025-11-23 01:03 · 11 months ago
Last analysis
2025-11-23 01:06 · 11 months ago
Hashes
MD5 fbd156c750e6d53e2d7fd89c74cd3830 Sha1 2b77eb7ba89623c5e29e80fab5571fd785604f44 Sha256 e5e898f64ad5e601ac49ed829306f500ad2fee88a99e7e4c394789e826156820 Sha384 c221cc1d1277d2172d6b2d17f6822ea60cc0f85c1b679703bbc89eb27b8a56e542c2a02d2b0ff138246e30802ccb4cfd Sha512 6fd4fc3a3034d24473f30566a1bde027229b09f342d5cd8cca9ab4956d6e6d820c39f9fb8128935045e81a30ad1b6f28083cb05dd0df5d7e8aeafd61c485ea9e SSDeep 6144:dWL+PQIshfTR7dkYsytbu5Dmmsde2mpZX:sisoyg5Dm5E2mrX TLSH 74746A1373A4AA3BD1BE173BA03206155BF4D503BB16E38B5A6855BC6E133868D907F3
Detection
PeID
Microsoft Visual C# / Basic .NET
1 malicious · 3 files
EXEfbd156c750e6d53e2d7fd89c74cd3830QuasarRat
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key y1ajgdhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 172.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory michuhuhuhu
InstallName Updathuhuhuhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey servhuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag 2huhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::崙�䬲쌣荱틞鮃ቛ梋쳇䣗䞀뽄蟍⫳큑乌ᘖ菓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䵰﭂ﴄ夎ㄫ鮧ᅴ鴷칈ꑕﶝ璊縄㬈㒌⧣絛ೢ꺉::례ꥳ鸹暿ᷧ塆ੳ꛿薁얯㐤피鑰ꩱ㎪炅箉㐢()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::騥頎鳅㷑䪣衸뭏ퟫ砺�逮ꐆ㇍ဋﴲダ仯￸뺰()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::get_Exiting()
brtrue.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
ldsfld 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::뾶㢛ɛ篆燬弈ᢨ猌ྔ欌໰‣㶑꛽�t㶾�㟞
callvirt System.Void 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::鏼餰죅藛ꡖ㾹垑挅黉髧决攪敺髢욀쥑⯈嬘씌ಎ()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::滿➷⁸쮸Ž歋쓋갸ၲⰺ1䅔⮑㇨銃鎜�詶()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::崙�䬲쌣荱틞鮃ቛ梋쳇䣗䞀뽄蟍⫳큑乌ᘖ菓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 䵰﭂ﴄ夎ㄫ鮧ᅴ鴷칈ꑕﶝ璊縄㬈㒌⧣絛ೢ꺉::례ꥳ鸹暿ᷧ塆ੳ꛿薁얯㐤피鑰ꩱ㎪炅箉㐢()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::騥頎鳅㷑䪣衸뭏ퟫ砺�逮ꐆ㇍ဋﴲダ仯￸뺰()
brfalse.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Boolean 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::get_Exiting()
brtrue.s IL_0040: call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
ldsfld 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::뾶㢛ɛ篆燬弈ᢨ猌ྔ欌໰‣㶑꛽�t㶾�㟞
callvirt System.Void 阶欏壀䅏턶븏疔紴₍㥁뤾摴鮛섚ﷹᬫ쀭�釲::鏼餰죅藛ꡖ㾹垑挅黉髧决攪敺髢욀쥑⯈嬘씌ಎ()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::쀜ꂅ啓ಃ夳ﭡ꼉少썸縐㺅塋ꊻᄞ㸥箶῾賷()
call System.Void 夗宀ӑ盺ᾄ陼苦ဆ㔺桁섄젷䬅堙脖軧::滿➷⁸쮸Ž歋쓋갸ၲⰺ1䅔⮑㇨銃鎜�詶()
ret <null>
CnC CNCmalicious
172.huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 3 files
EXEfbd156c750e6d53e2d7fd89c74cd3830QuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key y1ajgdhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 172.huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory michuhuhuhu
InstallName Updathuhuhuhuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey servhuhuhuhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag 2huhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
172.huhuhuhuhuhuhu
fbd156c750e6d53e2d7fd89c74cd3830
Port PORTmalicious
1huhuhuhu
fbd156c750e6d53e2d7fd89c74cd3830
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙