QuasarRat PE Executable malware analysis – 2ce5b35ded2c

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXE2ce5b35ded2cde5859c1577496a27ed6QuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	5NknHMhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port
Host	193.1huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::뗉춘ݜ쯇ꃩ萼쬋ﻏ啨ࢎ扇绻뉱껥⩎릢宭폲(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ﵺš゜쯴综嚾澚䜑掂䢘빙纞礏�햶觙螄::㾍祌피�ﳳ萄鸠㇑�걍鷁ధ巹끔㖙�() brfalse.s IL_0040: call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() call System.Boolean 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::㲁ᑟꄰ⹻塻ᜦ迷렘쒫감䠡糄峵῎稱楫杻䡢() brfalse.s IL_0040: call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() call System.Boolean 趲눲끝㨕ᡈ䌃㼒쉍綾ℏ畊筢Ԩ齐ु手::get_Exiting() brtrue.s IL_0040: call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() ldsfld 趲눲끝㨕ᡈ䌃㼒쉍綾ℏ畊筢Ԩ齐ु手宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::㡂ꎠ棃捿伤髕೘闩뜲꬙岞﫨ﷱ�狳߉啗෩ callvirt System.Void 趲눲끝㨕ᡈ䌃㼒쉍綾ℏ畊筢Ԩ齐ु手::㜆ꌐ攢鍵졩㷬읗卜鼷㦍混ꡪ㉫镆궎�㤯數蓕() call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::ﭼ⻵齎퍪႖陼࿘ﶓ㟏景떠뿭꜔瘧ẽ荘() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::뗉춘ݜ쯇ꃩ萼쬋ﻏ啨ࢎ扇绻뉱껥⩎릢宭폲(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ﵺš゜쯴综嚾澚䜑掂䢘빙纞礏�햶觙螄::㾍祌피�ﳳ萄鸠㇑�걍鷁ధ巹끔㖙�() brfalse.s IL_0040: call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() call System.Boolean 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::㲁ᑟꄰ⹻塻ᜦ迷렘쒫감䠡糄峵῎稱楫杻䡢() brfalse.s IL_0040: call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() call System.Boolean 趲눲끝㨕ᡈ䌃㼒쉍綾ℏ畊筢Ԩ齐ु手::get_Exiting() brtrue.s IL_0040: call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() ldsfld 趲눲끝㨕ᡈ䌃㼒쉍綾ℏ畊筢Ԩ齐ु手宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::㡂ꎠ棃捿伤髕೘闩뜲꬙岞﫨ﷱ�狳߉啗෩ callvirt System.Void 趲눲끝㨕ᡈ䌃㼒쉍綾ℏ畊筢Ԩ齐ु手::㜆ꌐ攢鍵졩㷬읗卜鼷㦍混ꡪ㉫镆궎�㤯數蓕() call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::⋎∼䈯沐솑迱睋ꢔ饰㋑⫐塎ￚ쿄抶넑() call System.Void 宝욼ᢘ﮶ꞻ轻턽늕疷ᣗ鬀丕塉莅㨛冾쉂虐膣::ﭼ⻵齎퍪႖陼࿘ﶓ㟏景떠뿭꜔瘧ẽ荘() ret <null>

CnC CNCmalicious

193.1huhuhuhuhuhuhu

Port PORTmalicious

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential