QuasarRat PE Executable malware analysis – 22eec1e3676d

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

Microsoft Visual C# / Basic .NET

Symbol obfuscation

Low

1 malicious · 7 files

EXE22eec1e3676dc9583ecab4264b37558dQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	CGzloxhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	2huhuhuhu
Host	193.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
SubDirectory	1WvgEMhuhuhuhuhuhuhu
InstallName	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
Install	Suhuhuhuhu
Startup	csrhuhuhuhu
Mutex	0huhuhuhu
StartupKey	0huhuhuhu
HideFile	ZSwjiihuhuhuhuhuhuhuhuhuhuhu
EnableLogger	NET huhuhuhuhuhuhu
Tag	1huhuhuhu
LogDirectory	1huhuhuhu
ServerSignature	Ofhuhuhuhu
ServerCertificate	Lhuhuhuhu
InstallPath	1huhuhuhu
LogsPath	1huhuhuhu
UnattendedMod	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void xClient.Program::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	1062
Main Method	System.Void xClient.Program::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void xClient.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean xClient.Config.Settings::Initialize() brfalse.s IL_0040: call System.Void xClient.Program::Cleanup() call System.Boolean xClient.Program::Initialize() brfalse.s IL_0040: call System.Void xClient.Program::Cleanup() call System.Boolean xClient.Core.Networking.QuasarClient::get_Exiting() brtrue.s IL_0040: call System.Void xClient.Program::Cleanup() ldsfld xClient.Core.Networking.QuasarClient xClient.Program::ConnectClient callvirt System.Void xClient.Core.Networking.QuasarClient::Connect() call System.Void xClient.Program::Cleanup() call System.Void xClient.Program::Exit() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void xClient.Program::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	1062
Main Method	System.Void xClient.Program::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void xClient.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean xClient.Config.Settings::Initialize() brfalse.s IL_0040: call System.Void xClient.Program::Cleanup() call System.Boolean xClient.Program::Initialize() brfalse.s IL_0040: call System.Void xClient.Program::Cleanup() call System.Boolean xClient.Core.Networking.QuasarClient::get_Exiting() brtrue.s IL_0040: call System.Void xClient.Program::Cleanup() ldsfld xClient.Core.Networking.QuasarClient xClient.Program::ConnectClient callvirt System.Void xClient.Core.Networking.QuasarClient::Connect() call System.Void xClient.Program::Cleanup() call System.Void xClient.Program::Exit() ret <null>

CnC CNCmalicious

193.huhuhuhuhuhuhu

Port PORTmalicious

2huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential