QuasarRat PE Executable malware analysis – 2e4ecead6a50

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXE2e4ecead6a5091b349f7ffffe8419b6cAsyncRAT

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	D2973Fhuhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port	1huhuhuhu
Host	127huhuhuhu
ReconnectDelay	3huhuhuhu
Key	Suhuhuhuhu
SubDirectory	Clihuhuhuhu
InstallName	0huhuhuhu
Install	0huhuhuhu
Startup	fb240chuhuhuhuhuhuhuhuhuhuhu
Mutex	Quasahuhuhuhuhuhuhu
StartupKey	0huhuhuhu
HideFile	0huhuhuhu
EnableLogger	Ofhuhuhuhu
EncryptionKey	Lhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Key (AES_256)	-huhuhuhu
Pastebin	-huhuhuhu
ServerSignature	rCynzfhuhuhuhuhuhuhuhuhuhuhu
Install File	Sbihuhuhuhu
Mutex	cmdvhuhuhuhu
Group	cmdvhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.7.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	1957
Main Method	System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::Main(System.String[])
Main IL Instruction Count	20
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::舦▝蔃섪魗縖⍥㠔壻孌疆ᨱ嫼ǆ麤๰(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::鯗ꛠ堳䖘榰福绀ꛟ쟗๵☯ሿ䓩㯨똦ﴫ䫄(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::蕶ၲ審껫븬಻貂繙덽◚⡴ᚨ�薨ঁɊ熶冚峦() newobj System.Void zzlvzxicnbofmgzrfzwa.⇌ᆈ蕩ᦧ䶣腒髑珖痺祶豯༨沀⌬⪋::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.7.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	1957
Main Method	System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::Main(System.String[])
Main IL Instruction Count	20
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::舦▝蔃섪魗縖⍥㠔壻孌疆ᨱ嫼ǆ麤๰(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::鯗ꛠ堳䖘榰福绀ꛟ쟗๵☯ሿ䓩㯨똦ﴫ䫄(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void zzlvzxicnbofmgzrfzwa.뷱⊙뎧Ⰶ塦嘷촊⫌媡ﲂ굉쯸賋ꄡύ櫠䳁뺭툩ὼ::蕶ၲ審껫븬಻貂繙덽◚⡴ᚨ�薨ঁɊ熶冚峦() newobj System.Void zzlvzxicnbofmgzrfzwa.⇌ᆈ蕩ᦧ䶣腒髑珖痺祶豯༨沀⌬⪋::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

127huhuhuhu

Port PORTmalicious

1huhuhuhu

Key (AES_256) MUTEXmalicious

-huhuhuhu

Mutex MUTEXmalicious

cmdvhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential