QuasarRat PE Executable malware analysis – 043e5bdf1177

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

2 malicious · 4 files

EXE043e5bdf11779cac34eb9dd67b54d95dQuasarRat

EXE[Rebuild from dump]_0b2d90a7.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	E1E026huhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port	1huhuhuhu
Host	185.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
SubDirectory	Com10huhuhuhuhuhuhu
InstallName	ComChhuhuhuhuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	690599huhuhuhuhuhuhuhuhuhuhu
StartupKey	Com1huhuhuhuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	Mhuhuhuhu
LogDirectory	Lohuhuhuhu
ServerSignature	PV4ZURhuhuhuhuhuhuhuhuhuhuhu
ServerCertificate	MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	1huhuhuhu
UnattendedMod	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::鄖꘯ʦ٨矤⶞�뀓�滣͙꣢웥蝀왚⭉ꃫ(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::샵ꎍ饺扙闥柴ᛜ驰㱖爁㾋Ế뫯㔮㥵뱎鋠昳(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 頊앸︋졵㘑偐涭턙⛓囿ᠥ䙀쓜좭婧索暻ᤛ舂::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::鄖꘯ʦ٨矤⶞�뀓�滣͙꣢웥蝀왚⭉ꃫ(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 㘻Ï贪䇑͡㝴乽∩䇿କệ炽⻽츣垵釁鳩쪻ᤔ::샵ꎍ饺扙闥柴ᛜ驰㱖爁㾋Ế뫯㔮㥵뱎鋠昳(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 頊앸︋졵㘑偐涭턙⛓囿ᠥ䙀쓜좭婧索暻ᤛ舂::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

185.huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential