QuasarRat PE Executable malware analysis – 30d8b11b57c7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NETUPolyX 0.3 -> delikon

1 malicious · 3 files

EXE30d8b11b57c7fb8df51546ad82ba28cdQuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	01BCImhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	91.1huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey	Quasarhuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::ᙗאַꆗ뜽繙忻�㼎ឦǟ훢瀏윃�髴蜶浩ȋ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 妏뉼럯襇ﺃ툘盟첗臚㬂꽹뮏憩쒐딿퉇勾뗚::ၦ⑉䧩뉒嫮劗ఙ憎哽닼摐⹑㜆썈鎚램䯿撒㘒() brfalse.s IL_0040: call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() call System.Boolean 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::䬼菲탍ᳪ꧿赕⁽㷠ⓦ礛透䩯㤍눀ࢪЙ氿禮뢊뺯() brfalse.s IL_0040: call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() call System.Boolean 䴎䚿峳呹퇀ᅰ䦽枺ﵾѹทﬅ뉶蔑㌾ﱹ䟄::get_Exiting() brtrue.s IL_0040: call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() ldsfld 䴎䚿峳呹퇀ᅰ䦽枺ﵾѹทﬅ뉶蔑㌾ﱹ䟄銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::꧜䕉貤≬⎫겂ᚧ쀂嚡ϓዎ뵷弣驽셀匑힌ᒁ阦 callvirt System.Void 䴎䚿峳呹퇀ᅰ䦽枺ﵾѹทﬅ뉶蔑㌾ﱹ䟄::턢緽싕䚄⥶侴䋵դ㧊냱걚嵐㫑텓⑤ᾕ숼밳㚭旲() call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::㇃햚퉿龿枩痛ా㔭椺悬㡚啅냵툾잜詰�Ō欤() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::ᙗאַꆗ뜽繙忻�㼎ឦǟ훢瀏윃�髴蜶浩ȋ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 妏뉼럯襇ﺃ툘盟첗臚㬂꽹뮏憩쒐딿퉇勾뗚::ၦ⑉䧩뉒嫮劗ఙ憎哽닼摐⹑㜆썈鎚램䯿撒㘒() brfalse.s IL_0040: call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() call System.Boolean 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::䬼菲탍ᳪ꧿赕⁽㷠ⓦ礛透䩯㤍눀ࢪЙ氿禮뢊뺯() brfalse.s IL_0040: call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() call System.Boolean 䴎䚿峳呹퇀ᅰ䦽枺ﵾѹทﬅ뉶蔑㌾ﱹ䟄::get_Exiting() brtrue.s IL_0040: call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() ldsfld 䴎䚿峳呹퇀ᅰ䦽枺ﵾѹทﬅ뉶蔑㌾ﱹ䟄銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::꧜䕉貤≬⎫겂ᚧ쀂嚡ϓዎ뵷弣驽셀匑힌ᒁ阦 callvirt System.Void 䴎䚿峳呹퇀ᅰ䦽枺ﵾѹทﬅ뉶蔑㌾ﱹ䟄::턢緽싕䚄⥶侴䋵դ㧊냱걚嵐㫑텓⑤ᾕ숼밳㚭旲() call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::᪹폑찱垒⎥ﶒ䃝賂矇Ạ�綘ꇮ㺍嶒폨馲Ｆ�() call System.Void 銡倻鳧觇姆䰂ᡧ蟴ꎵ䋠뷅탇檶ꧧ呹ꔴ名匦::㇃햚퉿龿枩痛ా㔭椺悬㡚啅냵툾잜詰�Ō欤() ret <null>

CnC CNCmalicious

91.1huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential