QuasarRat PE Executable malware analysis – 338366fe714f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

Microsoft Visual C# / Basic .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXE338366fe714f15d5340e83a6291ba856QuasarRat

EXE[Rebuild from dump]_7d9f645a.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	PQabfVhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	6huhuhuhu
Host	172.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	rhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::໇떈沍ࠞ졕诡Ῥ⦧▂�콤깔⍰硓펵撰퍠磥꛺(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 簶诘�㞶堎ᐣ⽰ 膿즹✻줕᠆鶦㭤倰댒�::礕괬鍳ፖ喽㤀晿횴䩑�Ꙧ旲頮᬴猎跕烔㱄ጭ() brfalse.s IL_0040: call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() call System.Boolean 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::᷏〬썂෣둎뜁姏ᬷ㌠汵糼ֽ�쉱ǘ慿膗栢ᵐ() brfalse.s IL_0040: call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() call System.Boolean ᒈᚋ丙ꐛ홇㑗☖鈞뵍⁧푢硇錭㨫∏宧䢫䎡::get_Exiting() brtrue.s IL_0040: call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() ldsfld ᒈᚋ丙ꐛ홇㑗☖鈞뵍⁧푢硇錭㨫∏宧䢫䎡 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::俉峾꥜꥘ꑿㅅୈ㑴彮씩欞可೜筈뿨㗧雪� callvirt System.Void ᒈᚋ丙ꐛ홇㑗☖鈞뵍⁧푢硇錭㨫∏宧䢫䎡::఻ਹ笧᱊痩鵲悫ꔝ斉₟꣏ᄣৰ紥ꌯ捻⑑拼() call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::沵栂ᐼ嘅ⶖꂟ癄뇕筣魜䳂횸凷ẻ㩙仼淢뽍烅₁() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::໇떈沍ࠞ졕诡Ῥ⦧▂�콤깔⍰硓펵撰퍠磥꛺(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 簶诘�㞶堎ᐣ⽰ 膿즹✻줕᠆鶦㭤倰댒�::礕괬鍳ፖ喽㤀晿횴䩑�Ꙧ旲頮᬴猎跕烔㱄ጭ() brfalse.s IL_0040: call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() call System.Boolean 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::᷏〬썂෣둎뜁姏ᬷ㌠汵糼ֽ�쉱ǘ慿膗栢ᵐ() brfalse.s IL_0040: call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() call System.Boolean ᒈᚋ丙ꐛ홇㑗☖鈞뵍⁧푢硇錭㨫∏宧䢫䎡::get_Exiting() brtrue.s IL_0040: call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() ldsfld ᒈᚋ丙ꐛ홇㑗☖鈞뵍⁧푢硇錭㨫∏宧䢫䎡 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::俉峾꥜꥘ꑿㅅୈ㑴彮씩欞可೜筈뿨㗧雪� callvirt System.Void ᒈᚋ丙ꐛ홇㑗☖鈞뵍⁧푢硇錭㨫∏宧䢫䎡::఻ਹ笧᱊痩鵲悫ꔝ斉₟꣏ᄣৰ紥ꌯ捻⑑拼() call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::宻젼泭꾞ẋ⤤鳷䬁栠ȃ榏눻㙾앗鈬욬刃鸝() call System.Void 춊蹠鎦㳸ά嚞竲뜷⁆换Ꮗ뤸⑮�舙뺕⇼仄�::沵栂ᐼ嘅ⶖꂟ癄뇕筣魜䳂횸凷ẻ㩙仼淢뽍烅₁() ret <null>

CnC CNCmalicious

172.huhuhuhuhuhuhu

Port PORTmalicious

6huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential