QuasarRat PE Executable malware analysis – 45c59e66d710

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE45c59e66d7109f6b2c304260dc3261a8QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	VhXBMdhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	warewhuhuhuhuhuhuhu
Host	warewhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Phuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::朧्̛䦎雀튲솹ꅢῷ⡃ෲ�뫰揑☻⊛㶻(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 喃髾掎繑疑㗼枈옓�颶ᵟ媧퍡╳밝芧::ࠐ媭耡췡澎웘䅬㝒錊૆譩⠑靊昁箁䷘起妵罃() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ꂷᎊ漣鍈ﻷ꧶麴螯㸡鯿ﬗ﬑᰽뀌﷪쩢() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::get_Exiting() brtrue.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() ldsfld ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::㙉欼ㅩ쬀㊋囧驀ퟪ杅픆ￔ㜐屃沤줂䈷틁䟊 callvirt System.Void ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::﫽綳�᭡�念뉭憈鷎矅⨗ૂ㩈剅዆񁵟ụ꓆ű() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ኯⳐ砒찵웺榭霤珏⬗鋼ꖳ⡒ḻ戔鵾잣() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::朧्̛䦎雀튲솹ꅢῷ⡃ෲ�뫰揑☻⊛㶻(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 喃髾掎繑疑㗼枈옓�颶ᵟ媧퍡╳밝芧::ࠐ媭耡췡澎웘䅬㝒錊૆譩⠑靊昁箁䷘起妵罃() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ꂷᎊ漣鍈ﻷ꧶麴螯㸡鯿ﬗ﬑᰽뀌﷪쩢() brfalse.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Boolean ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::get_Exiting() brtrue.s IL_0040: call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() ldsfld ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::㙉欼ㅩ쬀㊋囧驀ퟪ杅픆ￔ㜐屃沤줂䈷틁䟊 callvirt System.Void ꘵덖�䱥櫃䇊밶쫞䫸⺙䉾撯絔螺笓⏽锱翵::﫽綳�᭡�念뉭憈鷎矅⨗ૂ㩈剅዆񁵟ụ꓆ű() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::첉埀猚甝㝀൏號㚡詑俹鋅迴邧䐛꜖䳥⇽剰ష猄() call System.Void 橔됥苜㿱ઢﺊ䧄ؽ�ᕽ쳞ة끣ﭷУ럨귔૛◲骻::ኯⳐ砒찵웺榭霤珏⬗鋼ꖳ⡒ḻ戔鵾잣() ret <null>

CnC CNCmalicious

warewhuhuhuhuhuhuhu

Port PORTmalicious

warewhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential