Deep Malware Analysis of 1a0c632f7e9409efbca74245f8e99283 | md5: 1a0c632f7e9409efbca74245f8e99283 | RAT | Malicious | QuasarRat | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.61

PE Executable

MD5: 1a0c632f7e9409efbca74245f8e99283

Size: 356.35 KB

application/x-dosexec

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	1a0c632f7e9409efbca74245f8e99283
Sha1	78554277391c28163255b456dd9bf40b39f9b31d
Sha256	92478c525daf58642a221dfda3782d6414d2040976fea242effffbdc854e813c
Sha384	d273195af8e9cbbaafa59d72ddcfd8189c9e81c533c36180a6f5ec4f6d6991655a7248b8498b790a6bfe3cf8f902bb0c
Sha512	0d5efd820343f524bd184467e33205ab348af2fdfa0ad21092982d41995ed5b2166099266e77fc9ab5bfd01811a7c47e925fcc58c7645ee98d182efd5d7862cd
SSDeep	6144:++NHXf500Mr5d2HIIIIIw9dVcXbRa/g2BxZKkZnwn6m8g2:1d50oG0jBxZKkZwn6m8g2
TLSH	A2748C1333A4E93BD1BE277AE03206154BB9D507B616E38F9A6855B82C533C68D913B3

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Malware Configuration - QuasarRAT config.

Config. Field0	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	eVC3EAhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	193.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Informations

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::㑥ͪ껼먈ꕜᶾ�Ǐ䗉䡍渥ྵ丵ﺧ槯過ꘓ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 떺䭈䒍뿣᳭鞯偛䂜聂順襧Ќꊃ麝�耋븄్ᝂ싔::‴ﻒ滭䒔捌ఫ袃꺓⃸ꅚ⪁얕햣詤젟�ញ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::氙旅䰣隖퐶釪ꛪⅮ爐ͪᾱ寘⧁ม䷅䊞ⳝ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::get_Exiting() brtrue.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() ldsfld ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉ �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::癤ືⷪ䜶ᬑ謹땁劙踝ࠚ寞ᖠᕑ뾏⤙ힴ鉉释㦘῔ callvirt System.Void ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::肒ղク窗➼뽂ퟖ獻짿㝆靅䀋ꮡ腤ﹺҠ䳍ꊓ朻() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::᥮⡆毂ʭԹ㐾㡧欼⓹띣ℬڤ승╲쉮ᘺ⡐濐쑏Ů() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::㑥ͪ껼먈ꕜᶾ�Ǐ䗉䡍渥ྵ丵ﺧ槯過ꘓ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 떺䭈䒍뿣᳭鞯偛䂜聂順襧Ќꊃ麝�耋븄్ᝂ싔::‴ﻒ滭䒔捌ఫ袃꺓⃸ꅚ⪁얕햣詤젟�ញ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::氙旅䰣隖퐶釪ꛪⅮ爐ͪᾱ寘⧁ม䷅䊞ⳝ() brfalse.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Boolean ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::get_Exiting() brtrue.s IL_0040: call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() ldsfld ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉ �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::癤ືⷪ䜶ᬑ謹땁劙踝ࠚ寞ᖠᕑ뾏⤙ힴ鉉释㦘῔ callvirt System.Void ⋞䣀곯ᔍɘ䠒藧틒씱⮀皏Ṣ宷聂陉꜉::肒ղク窗➼뽂ퟖ獻짿㝆靅䀋ꮡ腤ﹺҠ䳍ꊓ朻() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::庝ㄛⷔᚸ槆某﹐뜔滆�ႈ䞹䅙녲슳瞰�믤㞓萅() call System.Void �軫荒凅ᅣᰭᚱ緗樅껡㭭翄㠟픋ባ꭭핧敒⚱䆄::᥮⡆毂ʭԹ㐾㡧欼⓹띣ℬڤ승╲쉮ᘺ⡐濐쑏Ů() ret <null>

Artefacts

Name	Value
CnC	193.huhuhuhuhuhuhu
Port	1huhuhuhu

Full artefact values (URLs, paths, registry keys…) are available with Essential.

Unlock with Essential

1a0c632f7e9409efbca74245f8e99283 (356.35 KB)

Name	Value	Location
CnC	193.huhuhuhuhuhuhu Malicious	1a0c632f7e9409efbca74245f8e99283
Port	1huhuhuhu Malicious	1a0c632f7e9409efbca74245f8e99283