QuasarRat PE Executable malware analysis – 5e1d73785053

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 11 files

EXE5e1d737850530955506a5182ae3ecddaQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	HwssTMhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	4huhuhuhu
Host	192.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::蟅ڃ꭛犸톏牗⍋䦁鉃ꗞ렓壦賧師ඳट걮(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 唡ꆥ瀶쎣㴩ᲊ뛕䳑径꒚裴퍘䂰쒰锋큉�곑::ꫯ㬳쫊Ἃ㲘붬弖譐잜悒年莽�Լ鎧妟䔾() brfalse.s IL_0040: call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() call System.Boolean ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::鵰땸痼픦䞚车㞽ᄟ㞸ពℌ￷薁魼묔炆利ᣚ㈻帱() brfalse.s IL_0040: call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() call System.Boolean 榽⚠ፇ�ᱥඊ偵ી⺌၌애鰻手컋ʈ鑝ꥮꏋ㶊ꉧ::get_Exiting() brtrue.s IL_0040: call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() ldsfld 榽⚠ፇ�ᱥඊ偵ી⺌၌애鰻手컋ʈ鑝ꥮꏋ㶊ꉧ ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::蓉찙赡छٓㄌ࠸ᛡ圝魚똜앩슝ɀ㨶簘藺蝠楣뛡 callvirt System.Void 榽⚠ፇ�ᱥඊ偵ી⺌၌애鰻手컋ʈ鑝ꥮꏋ㶊ꉧ::辍槌橮⇌춡黸ʭ窀싖崤臻鼼＂㵢ꏲ탌﷢쐾돣ﰄ() call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::䫼瑷돬㒏⥂╶쇻㧸㾽푕䕒豆ꟶ쌿㶾풭笻䡨䲀駓() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::蟅ڃ꭛犸톏牗⍋䦁鉃ꗞ렓壦賧師ඳट걮(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 唡ꆥ瀶쎣㴩ᲊ뛕䳑径꒚裴퍘䂰쒰锋큉�곑::ꫯ㬳쫊Ἃ㲘붬弖譐잜悒年莽�Լ鎧妟䔾() brfalse.s IL_0040: call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() call System.Boolean ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::鵰땸痼픦䞚车㞽ᄟ㞸ពℌ￷薁魼묔炆利ᣚ㈻帱() brfalse.s IL_0040: call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() call System.Boolean 榽⚠ፇ�ᱥඊ偵ી⺌၌애鰻手컋ʈ鑝ꥮꏋ㶊ꉧ::get_Exiting() brtrue.s IL_0040: call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() ldsfld 榽⚠ፇ�ᱥඊ偵ી⺌၌애鰻手컋ʈ鑝ꥮꏋ㶊ꉧ ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::蓉찙赡छٓㄌ࠸ᛡ圝魚똜앩슝ɀ㨶簘藺蝠楣뛡 callvirt System.Void 榽⚠ፇ�ᱥඊ偵ી⺌၌애鰻手컋ʈ鑝ꥮꏋ㶊ꉧ::辍槌橮⇌춡黸ʭ窀싖崤臻鼼＂㵢ꏲ탌﷢쐾돣ﰄ() call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::殤ự幍瀇梲㩼浳屫鞙展朰䚉朴偣➂ኊ酷() call System.Void ᫠ವ௓麔ܨ竩�跺꘯鞲ꤪꚽ诵랚镾::䫼瑷돬㒏⥂╶쇻㧸㾽푕䕒豆ꟶ쌿㶾풭笻䡨䲀駓() ret <null>

CnC CNCmalicious

192.huhuhuhuhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential