QuasarRat PE Executable malware analysis – 54a516f546a1

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

Microsoft Visual C# / Basic .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXE54a516f546a11bf364029b4e5a53c2b7QuasarRat

EXE[Rebuild from dump]_62405b7a.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	1wnC7chuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	6huhuhuhu
Host	172.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	qhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::�⚥氳࿤侅렧ส麁祣皴ㅔ耊䀦攍ᕪ韴簗�(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 䃵৽雗㩝�㙸栗결⿀탙匽η郏퐨鯴䠳‏僫::譥⡑⢷䕱�賊傞裚炿⸀쪳⾓얶ᶣ⎈��() brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() call System.Boolean ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ಳ볷㴕嵏ค㶤贗訹灷갖༥鳟�骏䦠㦅鮟徲쵪() brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() call System.Boolean ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::get_Exiting() brtrue.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() ldsfld ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::獏䷵⻛ĩຏ誊䂊㊡勤๬눵鐆액£늽ᔍ�푆 callvirt System.Void ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::쨔奨ي쮍鈜睃꣞鱊㬉쑢쭠眆됄崫걱Ш꼡ﻐ꘦() call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::癥섹柪☎쫻푦鋓㐄˱韺㋚♇炕㨰螾Ⴀណꐅ() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::�⚥氳࿤侅렧ส麁祣皴ㅔ耊䀦攍ᕪ韴簗�(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 䃵৽雗㩝�㙸栗결⿀탙匽η郏퐨鯴䠳‏僫::譥⡑⢷䕱�賊傞裚炿⸀쪳⾓얶ᶣ⎈��() brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() call System.Boolean ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ಳ볷㴕嵏ค㶤贗訹灷갖༥鳟�骏䦠㦅鮟徲쵪() brfalse.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() call System.Boolean ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::get_Exiting() brtrue.s IL_0040: call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() ldsfld ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::獏䷵⻛ĩຏ誊䂊㊡勤๬눵鐆액£늽ᔍ�푆 callvirt System.Void ᘆ鋵厙曮㬺䃒뙣⑗ᢖẛ쯤䊆ꅈ곴≒䃰㍼门::쨔奨ي쮍鈜睃꣞鱊㬉쑢쭠眆됄崫걱Ш꼡ﻐ꘦() call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::ʒ俨䳱픴䳵࿦赕픇ᚺ⵻괫Ꝅ�懽㇜ⱗ刨֩() call System.Void ㍐襼쾱�⑎龳则빭굛쓴⨈늮ࢪ휃㉁胩�::癥섹柪☎쫻푦鋓㐄˱韺㋚♇炕㨰螾Ⴀណꐅ() ret <null>

CnC CNCmalicious

172.huhuhuhuhuhuhu

Port PORTmalicious

6huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential