QuasarRat PE Executable malware analysis – 7790fcc6ee9a

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 5 files

EXE7790fcc6ee9a18d06dccc9bd0bd65007QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	08FD21huhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port	4huhuhuhu
Host	82.6huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
SubDirectory	SKLdhuhuhuhuhuhuhu
InstallName	QKnxhuhuhuhuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	2ca9c7huhuhuhuhuhuhuhuhuhuhu
StartupKey	exhuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	Bhuhuhuhu
LogDirectory	Lhuhuhuhu
ServerSignature	Z60tGphuhuhuhuhuhuhuhuhuhuhu
ServerCertificate	MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	1huhuhuhu
UnattendedMod	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1574
Main Method	System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::陗޴踞뀐㌿᪠ᱜ➩˾헿괪鬗棇ᒋꩾ뎗标轈쓍(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::�碍틷楹Ḉ듎둎ﾟѕ莑夷떆ᆆ텹ᕹ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void ࠓ惶㪵龠︯㖩졂䐤葰房硲刹픤梐쭯ᛕᬩꮦ::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1574
Main Method	System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::陗޴踞뀐㌿᪠ᱜ➩˾헿괪鬗棇ᒋꩾ뎗标轈쓍(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 촏쵁擐涩ᙖ〉⃀왯빂ﳍ怷䇯쁤ﯫ衧顭䑨::�碍틷楹Ḉ듎둎ﾟѕ莑夷떆ᆆ텹ᕹ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void ࠓ惶㪵龠︯㖩졂䐤葰房硲刹픤梐쭯ᛕᬩꮦ::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

82.6huhuhuhuhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential