QuasarRat PE Executable malware analysis – 617fbf5e6dc3

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXE617fbf5e6dc316e53a1d5b27ba28c65aQuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	0gx2Rnhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	5.tcphuhuhuhuhuhuhu
Host	5.tcphuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	svhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::騕ֈ롿䬟㗚䡛紻댄⦻刅帚ᩍ湷龾謍븓㨋䬱(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 㟮璞�笾ᅑ䌝խ僇꽺㤐ힷᶫ돠�ㅄﵮ䴞ᆆꅮ::鶬瀏嵮꣜ᢑ习஬纩軥ꪍꈄ䙬⼐捎ⶃ༟뼧() brfalse.s IL_0040: call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() call System.Boolean 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::坅㉫㔀ⴓ餝妅됵䦩깝∟揹ꊛㄨ浜棏浈柦() brfalse.s IL_0040: call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() call System.Boolean 䃟캳ᗼ猂਋晇ᔓ웴菩ጵ퍥먣瀵㔻젝⮱ᛂँ秗::get_Exiting() brtrue.s IL_0040: call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() ldsfld 䃟캳ᗼ猂਋晇ᔓ웴菩ጵ퍥먣瀵㔻젝⮱ᛂँ秗㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::盐阸ﱘ웷鉩엠�텂䶵㌀␘㴾빡엩ꉜઍ嘥∃᩺ callvirt System.Void 䃟캳ᗼ猂਋晇ᔓ웴菩ጵ퍥먣瀵㔻젝⮱ᛂँ秗::ōᵃᦂ걚뮙⹚⾉鞜쌼襲帰䠈迩ﭽᤅ箾餺ꪹ() call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::㺻疫唢ᤤ邢퟇궙饀㒦Үᵜ陵୭뾀お狦좨搆貂() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::騕ֈ롿䬟㗚䡛紻댄⦻刅帚ᩍ湷龾謍븓㨋䬱(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 㟮璞�笾ᅑ䌝խ僇꽺㤐ힷᶫ돠�ㅄﵮ䴞ᆆꅮ::鶬瀏嵮꣜ᢑ习஬纩軥ꪍꈄ䙬⼐捎ⶃ༟뼧() brfalse.s IL_0040: call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() call System.Boolean 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::坅㉫㔀ⴓ餝妅됵䦩깝∟揹ꊛㄨ浜棏浈柦() brfalse.s IL_0040: call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() call System.Boolean 䃟캳ᗼ猂਋晇ᔓ웴菩ጵ퍥먣瀵㔻젝⮱ᛂँ秗::get_Exiting() brtrue.s IL_0040: call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() ldsfld 䃟캳ᗼ猂਋晇ᔓ웴菩ጵ퍥먣瀵㔻젝⮱ᛂँ秗㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::盐阸ﱘ웷鉩엠�텂䶵㌀␘㴾빡엩ꉜઍ嘥∃᩺ callvirt System.Void 䃟캳ᗼ猂਋晇ᔓ웴菩ጵ퍥먣瀵㔻젝⮱ᛂँ秗::ōᵃᦂ걚뮙⹚⾉鞜쌼襲帰䠈迩ﭽᤅ箾餺ꪹ() call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::官�率掷㶗礹Ÿ婑住蚃䚎ꎹꡤ끢긗⪔() call System.Void 㜩捕㸾鼲ᕨ둒ⷰ롵晵⢮ﹸ◢㭌ꄼꐻⲼ䚼䧹::㺻疫唢ᤤ邢퟇궙饀㒦Үᵜ陵୭뾀お狦좨搆貂() ret <null>

CnC CNCmalicious

5.tcphuhuhuhuhuhuhu

Port PORTmalicious

5.tcphuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential