QuasarRat PE Executable malware analysis – 560d4f4daf00

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 5 files

EXE560d4f4daf00d6e1053377e371ee5391QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	2085D4huhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port	csgo7huhuhuhuhuhuhu
Host	csgo7huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Unityhuhuhuhuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	d546b0huhuhuhuhuhuhuhuhuhuhu
StartupKey	Unityhuhuhuhuhuhuhu
HideFile	1huhuhuhu
EnableLogger	0huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
ServerSignature	KYhddQhuhuhuhuhuhuhuhuhuhuhu
ServerCertificate	MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	1huhuhuhu
UnattendedMod	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::ᚊ뛟暰ւ┵糂윊ꓮ彖κ忻임౏탉濺鼠豌ậ廖(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::慞삕嬰띎墚꿲ꑨ㸭凱觘炐돼꜒䩠쿧Ʂ몥樷(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void ᓰ䕺계袬鑶უ꟩䝯�නꍙ憊丿탣鸩〞⚹젠볡::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::ᚊ뛟暰ւ┵糂윊ꓮ彖κ忻임౏탉濺鼠豌ậ廖(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ��⁻䪛躝⦎㋆짿榿࢔➞崒⳦耴ε飃쑩덚䳧ᵈ::慞삕嬰띎墚꿲ꑨ㸭凱觘炐돼꜒䩠쿧Ʂ몥樷(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void ᓰ䕺계袬鑶უ꟩䝯�නꍙ憊丿탣鸩〞⚹젠볡::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

csgo7huhuhuhuhuhuhu

Port PORTmalicious

csgo7huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential