QuasarRat PE Executable malware analysis – 01169e45c035

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE01169e45c035f262f4389d167f9d5971QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	M5I1OIhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	213.1huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	d9MMJuhuhuhuhuhuhuhu
AuthKey	Jl4um5huhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey	Quasarhuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	Wizahuhuhuhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	896
Main Method	System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::⏥ꟷᎃి䵃齞䉷蜞麃ƪ焖坮h뛧뻆鹦쿾㇥(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 回혦▛䀅饹뀍⭛넔揃⥀孟쌩�๯찀븞ᶋṜ᱋::狭枋ﺔ䧣痫跧恄ⰼ鼨購擮퍄빉٠阞᭺憔怐焪뭣() brfalse.s IL_0040: call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() call System.Boolean 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::厾⫊⿢悳㎟�”鰒ᆎ᎒⿭몦㳿⼔�ੀ�춮㙒() brfalse.s IL_0040: call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() call System.Boolean 듇㪧즤旒ᄗ蝵䘉糳ꐏጆ�₥䇛␡❷梗垙䁴땷::get_Exiting() brtrue.s IL_0040: call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() ldsfld 듇㪧즤旒ᄗ蝵䘉糳ꐏጆ�₥䇛␡❷梗垙䁴땷 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::얦ኻ㲅₈�ၥ�૚᧓ꨯ낍ᤌ饬锁䯧屫獪 callvirt System.Void 듇㪧즤旒ᄗ蝵䘉糳ꐏጆ�₥䇛␡❷梗垙䁴땷::荄⚳㫵勼ʸ쏵䳪䖫䴠갋Ꮭｗ璺䃴巂Յ㖷ᄷ() call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::暐烊䆸乁햌⿘䕵�飅⬻␮䰓벅଒㘸攠뭐甌⟎() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	896
Main Method	System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::⏥ꟷᎃి䵃齞䉷蜞麃ƪ焖坮h뛧뻆鹦쿾㇥(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 回혦▛䀅饹뀍⭛넔揃⥀孟쌩�๯찀븞ᶋṜ᱋::狭枋ﺔ䧣痫跧恄ⰼ鼨購擮퍄빉٠阞᭺憔怐焪뭣() brfalse.s IL_0040: call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() call System.Boolean 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::厾⫊⿢悳㎟�”鰒ᆎ᎒⿭몦㳿⼔�ੀ�춮㙒() brfalse.s IL_0040: call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() call System.Boolean 듇㪧즤旒ᄗ蝵䘉糳ꐏጆ�₥䇛␡❷梗垙䁴땷::get_Exiting() brtrue.s IL_0040: call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() ldsfld 듇㪧즤旒ᄗ蝵䘉糳ꐏጆ�₥䇛␡❷梗垙䁴땷 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::얦ኻ㲅₈�ၥ�૚᧓ꨯ낍ᤌ饬锁䯧屫獪 callvirt System.Void 듇㪧즤旒ᄗ蝵䘉糳ꐏጆ�₥䇛␡❷梗垙䁴땷::荄⚳㫵勼ʸ쏵䳪䖫䴠갋Ꮭｗ璺䃴巂Յ㖷ᄷ() call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::堷㌔ᅪ뚣꬜矎슚য়ń苋⤆�⢚孍�궑䚯() call System.Void 퉤꺁錅㴷䯍尘⚯ㇽ佮쿡ц鮬僜놘﹘叭蝜敹䂁::暐烊䆸乁햌⿘䕵�飅⬻␮䰓벅଒㘸攠뭐甌⟎() ret <null>

CnC CNCmalicious

213.1huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential