QuasarRat PE Executable malware analysis – 2872e6628010

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE2872e662801005a47659a9518f64236cQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	zWf9gmhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	4huhuhuhu
Host	192.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::쪝㎰쵬벑⑨툐藆ݷ䑡ꊸ椲綉耣᪺ꫜ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ⽱٘㯹磌晥ꙮ㰭鶹ⵀᷧ㨸㺚≫鴥鏙㇘윾::헱ൻ诖愑됴䦬暣Ѩ狏�樭懔᧼讼磦ᡷ玤ﾣ() brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() call System.Boolean ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::衽è롼腲戦与鱣ݫﵯ솑龩㲋멀訕̙ᇱ㖱底ˁ() brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() call System.Boolean 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::get_Exiting() brtrue.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() ldsfld 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::䃈鸞Ƚ蒞旚Ἓ㌅ᓬ楯魢萖᠄߼Ꭷ࿡᫞튫눪 callvirt System.Void 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::鸑அ㮡騟Ნ貾ꗄ퉝罬焲लꎏ똻ﰏ뿧�ԉ᠌() call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::솋᧿껾ⴍꭳ꠼願ᵠʊ迦䎖睬﷉臁ꚪᢿ鉲ᘮ() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::쪝㎰쵬벑⑨툐藆ݷ䑡ꊸ椲綉耣᪺ꫜ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ⽱٘㯹磌晥ꙮ㰭鶹ⵀᷧ㨸㺚≫鴥鏙㇘윾::헱ൻ诖愑됴䦬暣Ѩ狏�樭懔᧼讼磦ᡷ玤ﾣ() brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() call System.Boolean ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::衽è롼腲戦与鱣ݫﵯ솑龩㲋멀訕̙ᇱ㖱底ˁ() brfalse.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() call System.Boolean 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::get_Exiting() brtrue.s IL_0040: call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() ldsfld 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::䃈鸞Ƚ蒞旚Ἓ㌅ᓬ楯魢萖᠄߼Ꭷ࿡᫞튫눪 callvirt System.Void 䐼ᘡᾏऩ雛䳹Ɨ䘀揉㳀鶌뷎퍜沠⠄┱㲋ೝ::鸑அ㮡騟Ნ貾ꗄ퉝罬焲लꎏ똻ﰏ뿧�ԉ᠌() call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::驥窦⏷��釠烐䠬ｌ纝李䣪ዮ㵱婠챡耩Ⱃ淆貊() call System.Void ϛ芴ἵ霼ࢻ驿尭䥊﹞⊕�븓૤ꡂ⿆::솋᧿껾ⴍꭳ꠼願ᵠʊ迦䎖睬﷉臁ꚪᢿ鉲ᘮ() ret <null>

CnC CNCmalicious

192.huhuhuhuhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential