Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: fc3a726da8293d06d748ae03945e597d
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
356.35 KB · 356,352 B
First seen
2025-11-23 00:49 · 11 months ago
Last seen
2025-11-23 00:49 · 11 months ago
Last analysis
2025-11-23 02:17 · 11 months ago
Hashes
MD5 fc3a726da8293d06d748ae03945e597d Sha1 8827449ef5efeeb1a2b26497396954d151e56de3 Sha256 9ee1b15f5376785c4d71d3f726fa45e5ce8310409fc506bea64d14426e185e28 Sha384 72ca94f30390976ab2e62fc9b1aa7dd6fb1e24433a97f9af2bc334c29c4d8e4395aa564ef9c15f5fa7999157387d9c32 Sha512 5a4e83d9ae4fa3ed1575cd18e3b3faa114fc95954564c4c5650b175a60bc069b6a0b467ba82b6db41b4eac9a4f660843677ab22784560d8cf5b70b03ac88cb2b SSDeep 6144:G46bPXhLApfpwc4FBGuVKbofr9Pn2jhOeRPPxn6:DmhApL4FBXxr9P2jMeRnxn6 TLSH 92749D6777A8E93BD1FD1736E432061547B0D407BA12F38B6A6C55B86E233868D813B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 7 files
EXEfc3a726da8293d06d748ae03945e597dQuasarRat
Structure
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key aLOO2Jhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port azharhuhuhuhuhuhuhu
Host azharhuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory shuhuhuhu
InstallName sethuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Sthuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag shuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting()
brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ
callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪()
brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting()
brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ
callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�()
call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎()
ret <null>
CnC CNCmalicious
azharhuhuhuhuhuhuhu
Port PORTmalicious
azharhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙