QuasarRat PE Executable malware analysis – 36a1d87cd994

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXE36a1d87cd99435dbb658f5b73f73dd1fQuasarRat

EXE[Rebuild from dump]_bed54b4e.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	0Y3FE4huhuhuhuhuhuhu
Version	1.huhuhuhu
Port
Host	193.1huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	kyhuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::溰�쭺뉬ᇃ纀扨틒፴ꆋ啸䮴ꄂ琅ሚ�耾⅒䔑閳(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ĺᅔꁈ�㳡궻篳虌掜ꦶ＾ᗱꩃ씓ۢ䂦::ኾｿ쭬ኑ㖛ﬗ뷘톝캿㉆賈ꖶ朸꼦瓟㊈() brfalse.s IL_0040: call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() call System.Boolean �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::첩䝷砧ශ䗄冓됫䃱ᖣ媊끍骩ᆖ圬᳿瑮() brfalse.s IL_0040: call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() call System.Boolean ♏ጸ渡誫ጷ䨏‌ճ埍⽖ꂖ间蛛ᩄ끞쑜ꥡ貮::get_Exiting() brtrue.s IL_0040: call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() ldsfld ♏ጸ渡誫ጷ䨏‌ճ埍⽖ꂖ间蛛ᩄ끞쑜ꥡ貮 �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::爈뫦菡ꔄꔖ⋏ꎎꟹ儗⛄䧏鵫ﭠ㈇㐊㻰搽괟꼠 callvirt System.Void ♏ጸ渡誫ጷ䨏‌ճ埍⽖ꂖ间蛛ᩄ끞쑜ꥡ貮::났㻅頔ꛘ�쐇濧텚⚥�ꩍ⛃뛶ꜱ产폘∀ꊅ᯹() call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::뿇䖸➜홹좽困潟砝텨멝ꣵ붣︛ಗ햀Ḫ錛璢㑹() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::溰�쭺뉬ᇃ纀扨틒፴ꆋ啸䮴ꄂ琅ሚ�耾⅒䔑閳(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ĺᅔꁈ�㳡궻篳虌掜ꦶ＾ᗱꩃ씓ۢ䂦::ኾｿ쭬ኑ㖛ﬗ뷘톝캿㉆賈ꖶ朸꼦瓟㊈() brfalse.s IL_0040: call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() call System.Boolean �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::첩䝷砧ශ䗄冓됫䃱ᖣ媊끍骩ᆖ圬᳿瑮() brfalse.s IL_0040: call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() call System.Boolean ♏ጸ渡誫ጷ䨏‌ճ埍⽖ꂖ间蛛ᩄ끞쑜ꥡ貮::get_Exiting() brtrue.s IL_0040: call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() ldsfld ♏ጸ渡誫ጷ䨏‌ճ埍⽖ꂖ间蛛ᩄ끞쑜ꥡ貮 �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::爈뫦菡ꔄꔖ⋏ꎎꟹ儗⛄䧏鵫ﭠ㈇㐊㻰搽괟꼠 callvirt System.Void ♏ጸ渡誫ጷ䨏‌ճ埍⽖ꂖ间蛛ᩄ끞쑜ꥡ貮::났㻅頔ꛘ�쐇濧텚⚥�ꩍ⛃뛶ꜱ产폘∀ꊅ᯹() call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::雌ྏ崔۶ᅐ꣈集뉄밥蘬ਝꪄ퓧�층೥ᥠↅ() call System.Void �벀莴Ỿ딚␰픎뤏東멑ꂠ颬専驜ﵹ⪏韅녔::뿇䖸➜홹좽困潟砝텨멝ꣵ붣︛ಗ햀Ḫ錛璢㑹() ret <null>

CnC CNCmalicious

193.1huhuhuhuhuhuhu

Port PORTmalicious

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential