QuasarRat PE Executable malware analysis – 52aca7436e75

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXE52aca7436e75dfc6d4bed1e3024fac95QuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	1BC1BBhuhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port	4huhuhuhu
Host	8.14huhuhuhu
ReconnectDelay	5huhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	db894bhuhuhuhuhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	hhuhuhuhu
LogDirectory	Lhuhuhuhu
ServerSignature	LTEqrehuhuhuhuhuhuhuhuhuhuhu
ServerCertificate	MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu
UnattendedMod	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::埼ை쭹깵䷞絢屨㭇ꮬ표ᷛኈ맭另鍋쟡(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::쬵ᙖ⪵㱅쮋켲穏赓痮⪩ᘴ崧တಽ业䈄遲嗅躵ⱜ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 䔶쾛루붳嘗늅ŀ뽸㣭袈鞉ヒ찪撔䍍꼗ဦ䉝࠰䥷::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::埼ை쭹깵䷞絢屨㭇ꮬ표ᷛኈ맭另鍋쟡(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ɯଚ妕䑤虡�沩㕸뗪緇ƥᄚ阣ࣥ᝺⒑붙鴅::쬵ᙖ⪵㱅쮋켲穏赓痮⪩ᘴ崧တಽ业䈄遲嗅躵ⱜ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 䔶쾛루붳嘗늅ŀ뽸㣭袈鞉ヒ찪撔䍍꼗ဦ䉝࠰䥷::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

8.14huhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential