QuasarRat PE Executable malware analysis – 698586573cc7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE698586573cc74b9f2262e213ff76db55QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	Rsz1tYhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	hard-huhuhuhuhuhuhu
Host	hard-huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Kuhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::籚ನᄀ⌨﷧ⴲᬭ豺꧜뗋ᛙ엢㜻〓풼돓౮袀ﲷ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ␰䰯꒛蒜瓅䶊視᳆怅鉗㹗퀮ꕊ垍૏쭀඙嶐㾖ꭆ::폪픆嗘▜넹휕歘ﰆ윘榜ﴹ㚧巒ⱚ�肶⸚繤ꈙ() brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() call System.Boolean 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::컉à侂寊�◜괿䚡텂緜悒㼯赎筥扮爗() brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() call System.Boolean ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::get_Exiting() brtrue.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() ldsfld ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::︨⩮깛諾圵젙狋톊炔ꇓ礞绋뻣ᷚ萿̦器袻 callvirt System.Void ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::ﶽ歑蝳逌ﱐ䍣質뒲௻ꤧﻝ뿹�꿩슩꧆벝ꃥퟹҺ() call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::璭�먪鈯铫㦢렫ꛪ쓩쫹軂ꌵᶐ噫ꐍ㧡쮈⮫ሃ() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::籚ನᄀ⌨﷧ⴲᬭ豺꧜뗋ᛙ엢㜻〓풼돓౮袀ﲷ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ␰䰯꒛蒜瓅䶊視᳆怅鉗㹗퀮ꕊ垍૏쭀඙嶐㾖ꭆ::폪픆嗘▜넹휕歘ﰆ윘榜ﴹ㚧巒ⱚ�肶⸚繤ꈙ() brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() call System.Boolean 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::컉à侂寊�◜괿䚡텂緜悒㼯赎筥扮爗() brfalse.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() call System.Boolean ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::get_Exiting() brtrue.s IL_0040: call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() ldsfld ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::︨⩮깛諾圵젙狋톊炔ꇓ礞绋뻣ᷚ萿̦器袻 callvirt System.Void ៾�ﷁ䄩蠫祟袘ފٶ橳∛ﶖ뿫瞾ힸ튃旆쐌쌁::ﶽ歑蝳逌ﱐ䍣質뒲௻ꤧﻝ뿹�꿩슩꧆벝ꃥퟹҺ() call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::ᳵ闗숟ӄ饒䜮㠗옉鎺猏鷒뛜漩₞�煾⇨湘鋓胯() call System.Void 䐓�劁ꁊ쩊ᇕ앞铭䀄셰澒₸䀈﹣ᢳ䝧맰외㡘::璭�먪鈯铫㦢렫ꛪ쓩쫹軂ꌵᶐ噫ꐍ㧡쮈⮫ሃ() ret <null>

CnC CNCmalicious

hard-huhuhuhuhuhuhu

Port PORTmalicious

hard-huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential