QuasarRat PE Executable malware analysis – 3dbe40ce4144

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Symbol obfuscation

Medium

1 malicious · 7 files

EXE3dbe40ce414429edaaa58abe90c678beQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	w56ph2huhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	85.huhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::ꬩꈇል粇尲㲪穬咜̌愋ᱮ㵜鲖韜⺿䐱럴탴㖃侤(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 鸶읖䞌孮䛼ᔏ馪꜁鲘譯簌冩㣏⩳ㆹ::䢽啮ٰ賲�ᗤ잎藃駃⊗쎻펎駯ꜽ絎눣ⳏ縊() brfalse.s IL_0040: call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() call System.Boolean 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::猯䬣邗↑໺챝◸箺帄侴쐫ᥤ若䭨櫠⪱⡵ނ䏕() brfalse.s IL_0040: call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() call System.Boolean 琻�䈴ꉠ蛈ﬂ莣놥⢁墫߭쿊媌꫶퓖摫::get_Exiting() brtrue.s IL_0040: call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() ldsfld 琻�䈴ꉠ蛈ﬂ莣놥⢁墫߭쿊媌꫶퓖摫 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::꛿ᖞ捺尐䭆�∶ﶽ퇤棂唠磂嫘鑜첱ຎ血疬㿬 callvirt System.Void 琻�䈴ꉠ蛈ﬂ莣놥⢁墫߭쿊媌꫶퓖摫::叉퓃㻜ﳟ鿯滖䖥亓튘덢鉇퍮鈄깦䬬窅쳴꧟() call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::輫鞾됼䅆쵟꼷崕斋돦ᶴꊫ泌鶇驓髒龗㸙䑻쀨() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::ꬩꈇል粇尲㲪穬咜̌愋ᱮ㵜鲖韜⺿䐱럴탴㖃侤(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 鸶읖䞌孮䛼ᔏ馪꜁鲘譯簌冩㣏⩳ㆹ::䢽啮ٰ賲�ᗤ잎藃駃⊗쎻펎駯ꜽ絎눣ⳏ縊() brfalse.s IL_0040: call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() call System.Boolean 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::猯䬣邗↑໺챝◸箺帄侴쐫ᥤ若䭨櫠⪱⡵ނ䏕() brfalse.s IL_0040: call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() call System.Boolean 琻�䈴ꉠ蛈ﬂ莣놥⢁墫߭쿊媌꫶퓖摫::get_Exiting() brtrue.s IL_0040: call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() ldsfld 琻�䈴ꉠ蛈ﬂ莣놥⢁墫߭쿊媌꫶퓖摫 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::꛿ᖞ捺尐䭆�∶ﶽ퇤棂唠磂嫘鑜첱ຎ血疬㿬 callvirt System.Void 琻�䈴ꉠ蛈ﬂ莣놥⢁墫߭쿊媌꫶퓖摫::叉퓃㻜ﳟ鿯滖䖥亓튘덢鉇퍮鈄깦䬬窅쳴꧟() call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::洩譌͉鯦腆暟謄昫踠ᓑ忪索䵅ⷡꤟ몆┠捛() call System.Void 댸�ꘄ릵ୢ줍鼡꡺唅೚᝟ⱛ뭞뷆꿭빴櫔챃뒊::輫鞾됼䅆쵟꼷崕斋돦ᶴꊫ泌鶇驓髒龗㸙䑻쀨() ret <null>

CnC CNCmalicious

85.huhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential