QuasarRat PE Executable malware analysis – 272a26b6a6d4

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXE272a26b6a6d4da9123afcb8dfac01267QuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	kNMp1thuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	92.2huhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey	Quasarhuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::쒱鍼�﴿礪�䎍嵉뇝꼍캳㕎ᆚ岍稨�滂嚧磿餷(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 沵輡⚁䏆璣胝婹铟᪘몟噧ꥯᰓ㌗睨䓅凹鈌::劤掚�䪽绡㺹줠趔⭑眴뒽啶ȥ酀⫶푏() brfalse.s IL_0040: call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() call System.Boolean 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::괕﵈쬰觯㥚諒ᓡ㓦땎�ᜪ賫梥콜㶴ᶎ㬮於() brfalse.s IL_0040: call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() call System.Boolean 踑ᯊႋ䨺郗縢됫꼩栴ἴ᯹◕쇤⾚朷᳆딒::get_Exiting() brtrue.s IL_0040: call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() ldsfld 踑ᯊႋ䨺郗縢됫꼩栴ἴ᯹◕쇤⾚朷᳆딒 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::맃眍頎�뫿央☎裱㽃㢲렵ҧ扞発쓬궞鲑 callvirt System.Void 踑ᯊႋ䨺郗縢됫꼩栴ἴ᯹◕쇤⾚朷᳆딒::ꅋ킢欥讖ඹẢ쵔⍈⼡ꋾ섫⾌짇溺큕() call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::饎噌슬ʩꊂ㵐溩ﰸ雌肋ɥⅧ➅鏒�蔒() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::쒱鍼�﴿礪�䎍嵉뇝꼍캳㕎ᆚ岍稨�滂嚧磿餷(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 沵輡⚁䏆璣胝婹铟᪘몟噧ꥯᰓ㌗睨䓅凹鈌::劤掚�䪽绡㺹줠趔⭑眴뒽啶ȥ酀⫶푏() brfalse.s IL_0040: call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() call System.Boolean 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::괕﵈쬰觯㥚諒ᓡ㓦땎�ᜪ賫梥콜㶴ᶎ㬮於() brfalse.s IL_0040: call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() call System.Boolean 踑ᯊႋ䨺郗縢됫꼩栴ἴ᯹◕쇤⾚朷᳆딒::get_Exiting() brtrue.s IL_0040: call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() ldsfld 踑ᯊႋ䨺郗縢됫꼩栴ἴ᯹◕쇤⾚朷᳆딒 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::맃眍頎�뫿央☎裱㽃㢲렵ҧ扞発쓬궞鲑 callvirt System.Void 踑ᯊႋ䨺郗縢됫꼩栴ἴ᯹◕쇤⾚朷᳆딒::ꅋ킢欥讖ඹẢ쵔⍈⼡ꋾ섫⾌짇溺큕() call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::基鎐飒픗攼ྉ᪹㪿�᮵⫰更薒㙬⴩풖좐䬣() call System.Void 逋彩ꃏ颎힇쟗墋儫᭙姿㌢猝䔦㢕⻘瘯巙::饎噌슬ʩꊂ㵐溩ﰸ雌肋ɥⅧ➅鏒�蔒() ret <null>

CnC CNCmalicious

92.2huhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential