QuasarRat PE Executable malware analysis – 3d179f5a4723

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

High

1 malicious · 17 files

EXE3d179f5a47238956c34c21dae73af66aQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	HbwXSThuhuhuhuhuhuhu
Version	2.huhuhuhu
Port	4huhuhuhu
Host	127huhuhuhu
ReconnectDelay	3huhuhuhu
Key	cfwy85huhuhuhuhuhuhu
SubDirectory	fIv3ULhuhuhuhuhuhuhuhuhuhuhu
InstallName	Suhuhuhuhu
Install	Clihuhuhuhu
Startup	1huhuhuhu
Mutex	1huhuhuhu
StartupKey	VNM_Mhuhuhuhuhuhuhu
HideFile	Cliehuhuhuhuhuhuhu
EnableLogger	1huhuhuhu
EncryptionKey	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	$77-Venom.exe
Full Name	$77-Venom.exe
EntryPoint	System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::Main(System.String[])
Scope Name	$77-Venom.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	$77-Venom
Assembly Version	2.1.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	2085
Main Method	System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::Main(System.String[])
Main IL Instruction Count	21
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::ꚤⒻ畼歴Ↄﮍשׂ츹ᣀ繕ᦽ氍뉉닾ঠ곴誊䪣ꈭ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ⱼᛚᒥ�翂诋嘢쬆祪匿徟逇�⚳䇆碬�㱹::쨑⌵ဆ⻾퓨�弸䪐쮎⥩纉館㭼锲쬃܌즏캲⫾() brfalse.s IL_0040: call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() call System.Boolean ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::北玊귋鬒췰䄩ꠘ髳뚞轗＜຺菗懀ޓ䩏() brfalse.s IL_0040: call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() call System.Boolean 濲쭤ꪀᖍ쮩綘鲇髹돺�篘ꕱ뛹�鰗혨Ⳏ⳵::get_Exiting() brtrue.s IL_0040: call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() ldsfld 濲쭤ꪀᖍ쮩綘鲇髹돺�篘ꕱ뛹�鰗혨Ⳏ⳵ ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::䠋屪缳⋅ᦷ廜묘ᾫ釞ﶢ໑윿�ί惘皂ẍ愚䯳 callvirt System.Void 濲쭤ꪀᖍ쮩綘鲇髹돺�篘ꕱ뛹�鰗혨Ⳏ⳵::�ݚ㺊鼛￐접�Ꮻ鄑厓欦벼繷ꯙ煽ᢦ() call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() call System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::ᣔ惨呉솨俣뼿鬳폒狦돶㳃箙⏞芁≪() call System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::芕哜裌뛄騤첨ퟱ䆫닛ﰑ㓊휟耫ছᜢᡴ㚘�ఆ() call System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::寍峿�௮ㅉ輔裭ꯞ뎑頦埈䤞�쇓☥쵔�堝() ret <null>
Module Name	$77-Venom.exe
Full Name	$77-Venom.exe
EntryPoint	System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::Main(System.String[])
Scope Name	$77-Venom.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	$77-Venom
Assembly Version	2.1.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	2085
Main Method	System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::Main(System.String[])
Main IL Instruction Count	21
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::ꚤⒻ畼歴Ↄﮍשׂ츹ᣀ繕ᦽ氍뉉닾ঠ곴誊䪣ꈭ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ⱼᛚᒥ�翂诋嘢쬆祪匿徟逇�⚳䇆碬�㱹::쨑⌵ဆ⻾퓨�弸䪐쮎⥩纉館㭼锲쬃܌즏캲⫾() brfalse.s IL_0040: call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() call System.Boolean ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::北玊귋鬒췰䄩ꠘ髳뚞轗＜຺菗懀ޓ䩏() brfalse.s IL_0040: call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() call System.Boolean 濲쭤ꪀᖍ쮩綘鲇髹돺�篘ꕱ뛹�鰗혨Ⳏ⳵::get_Exiting() brtrue.s IL_0040: call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() ldsfld 濲쭤ꪀᖍ쮩綘鲇髹돺�篘ꕱ뛹�鰗혨Ⳏ⳵ ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::䠋屪缳⋅ᦷ廜묘ᾫ釞ﶢ໑윿�ί惘皂ẍ愚䯳 callvirt System.Void 濲쭤ꪀᖍ쮩綘鲇髹돺�篘ꕱ뛹�鰗혨Ⳏ⳵::�ݚ㺊鼛￐접�Ꮻ鄑厓欦벼繷ꯙ煽ᢦ() call System.Void 渺蛪䪜눙㌵竟夸無얖糵ꭘ笼其乁覇幘ⱛ픜훕::贖췞实흒꒽衱뾝洭⬌淥㥼ᤚ聟埠() call System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::ᣔ惨呉솨俣뼿鬳폒狦돶㳃箙⏞芁≪() call System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::芕哜裌뛄騤첨ퟱ䆫닛ﰑ㓊휟耫ছᜢᡴ㚘�ఆ() call System.Void ᤩ鶜ᄠꥎ튡⠈䵛ẻ示糠澒笜폻᛿皆ビʑ묪::寍峿�௮ㅉ輔裭ꯞ뎑頦埈䤞�쇓☥쵔�堝() ret <null>

CnC CNCmalicious

127huhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential