QuasarRat PE Executable malware analysis – 619fa0ec0e1b

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

Medium

1 malicious · 7 files

EXE619fa0ec0e1b9d9ec80e7cb8fd803041QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	Oze2Yshuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	6huhuhuhu
Host	212.huhuhuhu
ReconnectDelay	3huhuhuhu
Key	QTFLuohuhuhuhuhuhuhu
AuthKey	RAuqmshuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Loghuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Lohuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::蝹簫˰楤ꎡ䜫㰣꫐︑嗪懹簀쓦쭏嗐⛰⏀(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean �ㄴ뜫も⾸ꁻ젒ꘈ�齋䉌痃ﱳ⑋줺ׇ槶⮞::㊐茌螭凙䣛欺嚅嶓檈ﰟ⬢遥�ᰉ뇒ᵢ钒⇉() brfalse.s IL_0040: call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() call System.Boolean 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::␿煪풕㙼墮꜆՛吞界ꂼ췵诇変㋚ꑊ␊縆棔̧() brfalse.s IL_0040: call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() call System.Boolean 怂璿➅첳큚诇닽엘ꄄꊾ긴칁ᄂ럼߇�樣쨥粥::get_Exiting() brtrue.s IL_0040: call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() ldsfld 怂璿➅첳큚诇닽엘ꄄꊾ긴칁ᄂ럼߇�樣쨥粥 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::㘜ꦆ⢝씱琲辛䷊䤸�㼂厾ꨂ↟◖풤듁念딸깽藰 callvirt System.Void 怂璿➅첳큚诇닽엘ꄄꊾ긴칁ᄂ럼߇�樣쨥粥::몀咺䎜㚻芝ꗐﹽ펤猫餭萯咂씜ュ켴뀘ꪛຠ㭬() call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::﻾ᗪ貥ﶞ裲ﶒ莯揮緑﹠♕役띩啊ἷ㳵鎡() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::蝹簫˰楤ꎡ䜫㰣꫐︑嗪懹簀쓦쭏嗐⛰⏀(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean �ㄴ뜫も⾸ꁻ젒ꘈ�齋䉌痃ﱳ⑋줺ׇ槶⮞::㊐茌螭凙䣛欺嚅嶓檈ﰟ⬢遥�ᰉ뇒ᵢ钒⇉() brfalse.s IL_0040: call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() call System.Boolean 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::␿煪풕㙼墮꜆՛吞界ꂼ췵诇変㋚ꑊ␊縆棔̧() brfalse.s IL_0040: call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() call System.Boolean 怂璿➅첳큚诇닽엘ꄄꊾ긴칁ᄂ럼߇�樣쨥粥::get_Exiting() brtrue.s IL_0040: call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() ldsfld 怂璿➅첳큚诇닽엘ꄄꊾ긴칁ᄂ럼߇�樣쨥粥 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::㘜ꦆ⢝씱琲辛䷊䤸�㼂厾ꨂ↟◖풤듁念딸깽藰 callvirt System.Void 怂璿➅첳큚诇닽엘ꄄꊾ긴칁ᄂ럼߇�樣쨥粥::몀咺䎜㚻芝ꗐﹽ펤猫餭萯咂씜ュ켴뀘ꪛຠ㭬() call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::皗⠝啱徝㝨ڷ퉵輿戥猵㈏뛃畉醐㍸䕥꯹() call System.Void 笆翁봬�迲㨎䍘钥ꖹ닮閍༩ფ︹::﻾ᗪ貥ﶞ裲ﶒ莯揮緑﹠♕役띩啊ἷ㳵鎡() ret <null>

CnC CNCmalicious

212.huhuhuhu

Port PORTmalicious

6huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential