QuasarRat PE Executable malware analysis – 6d9b59840baf

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

High

1 malicious · 28 files

EXE6d9b59840baf06c4fb56c17c4d817579QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version	Yxvb1zhuhuhuhuhuhuhuhuhuhuhu
Port	ILYAVOhuhuhuhuhuhuhuhuhuhuhu
Host	ILYAVOhuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	g6UoNkhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	DGsoPchuhuhuhuhuhuhuhuhuhuhu
InstallName	0huhuhuhu
Install	1huhuhuhu
Startup	ztwUithuhuhuhuhuhuhuhuhuhuhu
Mutex	9h2aXshuhuhuhuhuhuhuhuhuhuhu
StartupKey	0huhuhuhu
HideFile	1huhuhuhu
EnableLogger	1F8250huhuhuhuhuhuhuhuhuhuhu
EncryptionKey	w14qrLhuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::Main()
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	613
Main Method	System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::Main()
Main IL Instruction Count	21
Main IL	call System.Boolean 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::ꒄ嗡籂萵珜尙졧ሬ鏀㪞胄ࣛ脽긒衑鯜쉈() pop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::替꧍Ĩ�퀫䊉⭝餵먒崎먢俯莽ᜉמּᩔេ싲(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::㈽ꌒ⾄ň敁�洣ꉯ彡ꃖ练씕׻䖍⩊緗컐✅هᵟ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 芇恏뉩䕦듳딈�ꪕ졍ᴈ䜯ᛓ䩥흕뭤啽::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::Main()
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	613
Main Method	System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::Main()
Main IL Instruction Count	21
Main IL	call System.Boolean 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::ꒄ嗡籂萵珜尙졧ሬ鏀㪞胄ࣛ脽긒衑鯜쉈() pop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::替꧍Ĩ�퀫䊉⭝餵먒崎먢俯莽ᜉמּᩔេ싲(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 혏⫸泔ᣕ全ˎ廔Ꮛ䗗풏ꁸ埵釠剪勢﷯촟뻂⡥㢅::㈽ꌒ⾄ň敁�洣ꉯ彡ꃖ练씕׻䖍⩊緗컐✅هᵟ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 芇恏뉩䕦듳딈�ꪕ졍ᴈ䜯ᛓ䩥흕뭤啽::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

ILYAVOhuhuhuhuhuhuhuhuhuhuhu

Port PORTmalicious

ILYAVOhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential