QuasarRat PE Executable malware analysis – 4b0527a519b5

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

2 malicious · 2 files

EXE4b0527a519b522afc05dd8750ec3477aQuasarRat

EXE[Rebuild from dump]_289a91ef.exeQuasarRat

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	0TlqjFhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	4huhuhuhu
Host	127huhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::᪁꺇㭛Ⱂ汚쇎砷瓄⮘첫描搖�宫嬽胏본ᗇ檻(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 䂄꾣♚塤砲牌蘤꺚镾ß�௖ᴶ地煛ﲘࡼ慺⓯::騛⣎�ೱⷙꡒ투�넟鶪찎愾ˏ㧻럥瑶() brfalse.s IL_0040: call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() call System.Boolean ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::徲➯㵕滬੥⬽鯇㖋⥫䅫盼霦秏꽵橕굝() brfalse.s IL_0040: call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() call System.Boolean Ⓥ逾煛䋸坜ᜣ䶬鷎䯩뭙譌齧楣杶옲恐ι::get_Exiting() brtrue.s IL_0040: call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() ldsfld Ⓥ逾煛䋸坜ᜣ䶬鷎䯩뭙譌齧楣杶옲恐ι ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::ⲕ�ﾦ鋈褾䫄ꎧ鏸ⰰ��빬ꤢＣüᙹ管 callvirt System.Void Ⓥ逾煛䋸坜ᜣ䶬鷎䯩뭙譌齧楣杶옲恐ι::�徱쪒핬㐽㨍봈㪟沕暪硹᠑쪚珓৥�먧㊤() call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::䑌왵袎宛㴼㉃鈐⾪㣗择嶌�滩혃兟嵠쥦緁撃() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::᪁꺇㭛Ⱂ汚쇎砷瓄⮘첫描搖�宫嬽胏본ᗇ檻(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 䂄꾣♚塤砲牌蘤꺚镾ß�௖ᴶ地煛ﲘࡼ慺⓯::騛⣎�ೱⷙꡒ투�넟鶪찎愾ˏ㧻럥瑶() brfalse.s IL_0040: call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() call System.Boolean ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::徲➯㵕滬੥⬽鯇㖋⥫䅫盼霦秏꽵橕굝() brfalse.s IL_0040: call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() call System.Boolean Ⓥ逾煛䋸坜ᜣ䶬鷎䯩뭙譌齧楣杶옲恐ι::get_Exiting() brtrue.s IL_0040: call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() ldsfld Ⓥ逾煛䋸坜ᜣ䶬鷎䯩뭙譌齧楣杶옲恐ι ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::ⲕ�ﾦ鋈褾䫄ꎧ鏸ⰰ��빬ꤢＣüᙹ管 callvirt System.Void Ⓥ逾煛䋸坜ᜣ䶬鷎䯩뭙譌齧楣杶옲恐ι::�徱쪒핬㐽㨍봈㪟沕暪硹᠑쪚珓৥�먧㊤() call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::偼≖୹㙃参湟㟩꣑纔ꝓ䆶␹ꈰ곳ꋓ쩲㓐ヽ襗() call System.Void ꧼ᧝䶤噹壳ᴲ迅/镆磀ᔡꟈ룅馯㶜叅磡�::䑌왵袎宛㴼㉃鈐⾪㣗择嶌�滩혃兟嵠쥦緁撃() ret <null>

CnC CNCmalicious

127huhuhuhu

Port PORTmalicious

4huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential