Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

The file 37919c316ce58dac12ac2f2934a22bf3 is a PE Executable identified by Malva.RE as QuasarRat (rat). Static analysis extracted 6 embedded or derived files, a malware configuration (QuasarRAT config.) and 1 command-and-control endpoint. It matches 12 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Malicious
File type
PE Executable
Family
QuasarRat
Category
RAT
C2 (defanged)
45[.]141[.]151[.]105

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

1 malicious · 7 files
EXE37919c316ce58dac12ac2f2934a22bf3QuasarRat
Structure

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key Q2jTyFhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 45.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Quasahuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::ꙅ⢷兩뜿䂗騯抺烄ꟙՐ蛢ຆᑶ칃噅잿硓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 粜뀗蘿ര袁︈衂᪓쭂巐ৗꎲ쟡㭉招覞嬃ż::楖䆼콺歬뒦罂ꫤ뎣馢��墌셽⪦뫂頫疝ᐌ盨ꭎ()
brfalse.s IL_0040: call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
call System.Boolean 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::״蟘㨒팜Ⓢ᫓꿬ᨈ䍗镉敖甪䜪转瀪ꋽ逸똖긛麤()
brfalse.s IL_0040: call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
call System.Boolean 伓虫⁔䌸ဤ췭咡㐂ᖆ嚋닢掣♶藀忧::get_Exiting()
brtrue.s IL_0040: call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
ldsfld 伓虫⁔䌸ဤ췭咡㐂ᖆ嚋닢掣♶藀忧 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::ᢆ刘ꔫ麄頗곣ᆛ鎭�码꥜㐷破ꬄ彪㯮㽿焈ᒒ
callvirt System.Void 伓虫⁔䌸ဤ췭咡㐂ᖆ嚋닢掣♶藀忧::ᦎ霘䕒₴䁚ꍰ䇵戌윷㈞⌿犞︢꒺礼桌ˢ俆()
call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::艁ー✳һﱑ訋꼜᪣憓妮ᑜ䔛툿魑啐坧烎()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::ꙅ⢷兩뜿䂗騯抺烄ꟙՐ蛢ຆᑶ칃噅잿硓(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 粜뀗蘿ര袁︈衂᪓쭂巐ৗꎲ쟡㭉招覞嬃ż::楖䆼콺歬뒦罂ꫤ뎣馢��墌셽⪦뫂頫疝ᐌ盨ꭎ()
brfalse.s IL_0040: call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
call System.Boolean 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::״蟘㨒팜Ⓢ᫓꿬ᨈ䍗镉敖甪䜪转瀪ꋽ逸똖긛麤()
brfalse.s IL_0040: call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
call System.Boolean 伓虫⁔䌸ဤ췭咡㐂ᖆ嚋닢掣♶藀忧::get_Exiting()
brtrue.s IL_0040: call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
ldsfld 伓虫⁔䌸ဤ췭咡㐂ᖆ嚋닢掣♶藀忧 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::ᢆ刘ꔫ麄頗곣ᆛ鎭�码꥜㐷破ꬄ彪㯮㽿焈ᒒ
callvirt System.Void 伓虫⁔䌸ဤ췭咡㐂ᖆ嚋닢掣♶藀忧::ᦎ霘䕒₴䁚ꍰ䇵戌윷㈞⌿犞︢꒺礼桌ˢ俆()
call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::橎㜼ｐ砠阢੾᝕䵮Ẍ™箵䐲悹ꛧ鐣셅똵䨄()
call System.Void 끙倾ስ핽↰媔傓겇⿂쑺뒴债⛭嚦箥謵༏渻::艁ー✳һﱑ訋꼜᪣憓妮ᑜ䔛툿魑啐坧烎()
ret <null>

CnC CNCmalicious
45.1huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙