QuasarRat PE Executable malware analysis – 1caa0e600cdb

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE1caa0e600cdb335f39a22b33163b10c8QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	7VXTxthuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	windohuhuhuhuhuhuhu
Host	windohuhuhuhuhuhuhu
ReconnectDelay	2huhuhuhu
Key	oXCnUihuhuhuhuhuhuhu
AuthKey	h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	uhuhuhuhu
InstallName	jsthuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	uphuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	Nhuhuhuhu
LogDirectory	lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Ꭸ鴎瓐明Ď襪低⍢阴딗꿮빢鐥娆ɑ瓤䊳�(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 釺ᣛ珲サኮ蜩군쫡힧骄늧ꇂ鯴嘈䀨䉪챹�౏ࣈ::뙏转࢐Ｒ剟ꀘ퇀�Ꮂ佮돝訩螬柉䘕濏懄() brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() call System.Boolean ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::孳஝瘿꣟탞בֿﯬ溋堃櫓�릁䔣煡() brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() call System.Boolean 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::get_Exiting() brtrue.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() ldsfld 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎ ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::诂዆໚瞨剄풠Ꞅ褡黲뮺適铝ꫦᄗ洳델 callvirt System.Void 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::緵ꤐ�ᯢၸ㠙跛烽䬎梔獐鎡ᓆ収簬삨䧝瞢() call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::瑪䲢匘셨別ꊴ섑댛뷇㳮뻤Ꝋ䙵᧹⪢乽Ⱟ⮤() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::Ꭸ鴎瓐明Ď襪低⍢阴딗꿮빢鐥娆ɑ瓤䊳�(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 釺ᣛ珲サኮ蜩군쫡힧骄늧ꇂ鯴嘈䀨䉪챹�౏ࣈ::뙏转࢐Ｒ剟ꀘ퇀�Ꮂ佮돝訩螬柉䘕濏懄() brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() call System.Boolean ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::孳஝瘿꣟탞בֿﯬ溋堃櫓�릁䔣煡() brfalse.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() call System.Boolean 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::get_Exiting() brtrue.s IL_0040: call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() ldsfld 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎ ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::诂዆໚瞨剄풠Ꞅ褡黲뮺適铝ꫦᄗ洳델 callvirt System.Void 핚ﰣ懭闟㝛ᷘ홮浮᢮礊逷䦅ꟲ残據଎::緵ꤐ�ᯢၸ㠙跛烽䬎梔獐鎡ᓆ収簬삨䧝瞢() call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::ﯝꓕ욜㉋徕㉍쳇쌪ϼ珥⡠葊虍�➙摆通Ⲻ() call System.Void ⸱侾䝻Ⴈ䮐隇〨ꌗౝ徿�䋔ꆋ䤆ꯊ証�ᢠ::瑪䲢匘셨別ꊴ섑댛뷇㳮뻤Ꝋ䙵᧹⪢乽Ⱟ⮤() ret <null>

CnC CNCmalicious

windohuhuhuhuhuhuhu

Port PORTmalicious

windohuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential