QuasarRat PE Executable malware analysis – 3f518e452249

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXE3f518e4522499d048f5511285893d35dQuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	rQoR5vhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	mimalhuhuhuhuhuhuhu
Host	mimalhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::ᖌ菾렙ʓ�홥ڏ礅븮ᰜ⥑분�⟀劂꿇(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ꒳뤛众㌕㎄﷩磤鮔뷾⦧᫊�듾鳡➟褆奫홪섳::⟾ⷶ㮷踂ኺᴛ욂喔뉬ꔼ旚ﬡⱿ嚼ﻺ䤍�() brfalse.s IL_0040: call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() call System.Boolean ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::诡碊﬐�䊍⇕꼧锰ꃖ᳍䒚弗绐⢞茋牶핶() brfalse.s IL_0040: call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() call System.Boolean 싩個坭뾆旍绉럔䅜糧翐軓蝆⺳䈗୭㕚뻵䛏뀞::get_Exiting() brtrue.s IL_0040: call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() ldsfld 싩個坭뾆旍绉럔䅜糧翐軓蝆⺳䈗୭㕚뻵䛏뀞 ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::逞�槧僥胶Ⲷꅑ▣ꔹ䭝욿⮺쑜鵟紎逺᫓ᙼ callvirt System.Void 싩個坭뾆旍绉럔䅜糧翐軓蝆⺳䈗୭㕚뻵䛏뀞::朧立亃Ѿ៎略䕃䁯溏䊍⼓廞鷝킀宺ꀋ믜() call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::�맧竼喝උᤐ怐㊬ꋢڷ펯㙮ਉ㺏羄᭡춊() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::ᖌ菾렙ʓ�홥ڏ礅븮ᰜ⥑분�⟀劂꿇(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ꒳뤛众㌕㎄﷩磤鮔뷾⦧᫊�듾鳡➟褆奫홪섳::⟾ⷶ㮷踂ኺᴛ욂喔뉬ꔼ旚ﬡⱿ嚼ﻺ䤍�() brfalse.s IL_0040: call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() call System.Boolean ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::诡碊﬐�䊍⇕꼧锰ꃖ᳍䒚弗绐⢞茋牶핶() brfalse.s IL_0040: call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() call System.Boolean 싩個坭뾆旍绉럔䅜糧翐軓蝆⺳䈗୭㕚뻵䛏뀞::get_Exiting() brtrue.s IL_0040: call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() ldsfld 싩個坭뾆旍绉럔䅜糧翐軓蝆⺳䈗୭㕚뻵䛏뀞 ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::逞�槧僥胶Ⲷꅑ▣ꔹ䭝욿⮺쑜鵟紎逺᫓ᙼ callvirt System.Void 싩個坭뾆旍绉럔䅜糧翐軓蝆⺳䈗୭㕚뻵䛏뀞::朧立亃Ѿ៎略䕃䁯溏䊍⼓廞鷝킀宺ꀋ믜() call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::﷉贏ﺒ瘩뭿珅Ⱊ螦ౡ켺莩⌤⒌똷庵鉹⽝징⳸() call System.Void ǒ䛛誡ꦃ⁃䶙覔㐒ꥲ᫻주묃؅ᕷๆ쫆::�맧竼喝උᤐ怐㊬ꋢڷ펯㙮ਉ㺏羄᭡춊() ret <null>

CnC CNCmalicious

mimalhuhuhuhuhuhuhu

Port PORTmalicious

mimalhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential