QuasarRat PE Executable malware analysis – 5e58dec8e1f1

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE5e58dec8e1f1f18ecc29c24a98029f03QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	2aGeojhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	4huhuhuhu
Host	216.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	clihuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Anthuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	1Milhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::ᑕꚦ彩邷�ﱽ㵫ḅ㗄觯乤꒫䃅淍ᘘណ탇䗰(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 湓뼾奓㣶規庈僜蕉巃削걾᠊ꍯ剨貲ᮃ픖쏩ߓ::䌋㳗䴝钘ሽ﨓镽Ყ陥퀄॓匈緷ꬎ嫁ᶌ括霴() brfalse.s IL_0040: call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() call System.Boolean ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::ᢦ㿬̸ૹ⒡剛臕頢爬랬대䝶傺愒꘯() brfalse.s IL_0040: call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() call System.Boolean 뚕ꖮ㸳灵頁킈댊Ⱬᚈ썰멢茙ࢴ౰㼡ﺤ蘨쥁::get_Exiting() brtrue.s IL_0040: call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() ldsfld 뚕ꖮ㸳灵頁킈댊Ⱬᚈ썰멢茙ࢴ౰㼡ﺤ蘨쥁 ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::稼➿ࣵ푔諜捯硗硔ꁂ銊廋ĉ䍢娺䃉椇Ꮥ callvirt System.Void 뚕ꖮ㸳灵頁킈댊Ⱬᚈ썰멢茙ࢴ౰㼡ﺤ蘨쥁::≖⧭怴⧧擓澇숬䃙⹗퐭ෛ茡ᴡㅽ() call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::敶芍淙῟䲽îꞷ⁦ힷ൓捁姬ⲹ祪�뵾㚙◩() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::ᑕꚦ彩邷�ﱽ㵫ḅ㗄觯乤꒫䃅淍ᘘណ탇䗰(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 湓뼾奓㣶規庈僜蕉巃削걾᠊ꍯ剨貲ᮃ픖쏩ߓ::䌋㳗䴝钘ሽ﨓镽Ყ陥퀄॓匈緷ꬎ嫁ᶌ括霴() brfalse.s IL_0040: call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() call System.Boolean ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::ᢦ㿬̸ૹ⒡剛臕頢爬랬대䝶傺愒꘯() brfalse.s IL_0040: call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() call System.Boolean 뚕ꖮ㸳灵頁킈댊Ⱬᚈ썰멢茙ࢴ౰㼡ﺤ蘨쥁::get_Exiting() brtrue.s IL_0040: call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() ldsfld 뚕ꖮ㸳灵頁킈댊Ⱬᚈ썰멢茙ࢴ౰㼡ﺤ蘨쥁 ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::稼➿ࣵ푔諜捯硗硔ꁂ銊廋ĉ䍢娺䃉椇Ꮥ callvirt System.Void 뚕ꖮ㸳灵頁킈댊Ⱬᚈ썰멢茙ࢴ౰㼡ﺤ蘨쥁::≖⧭怴⧧擓澇숬䃙⹗퐭ෛ茡ᴡㅽ() call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::尞䒓쌮傠焉२夗췘籷╃괴塛ⲭ⛕ﴧ檰컯䟛倕() call System.Void ઻㿕욬홎㟁閙樤豘่䠏풯꿫⾍╮ﲷ䘹垙ᲈ뛖姼::敶芍淙῟䲽îꞷ⁦ힷ൓捁姬ⲹ祪�뵾㚙◩() ret <null>

CnC CNCmalicious

216.huhuhuhuhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential