QuasarRat PE Executable malware analysis – 850b5bb3a16f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE850b5bb3a16fa30c5723f15eb7ebeee2QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	EqflYfhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	4huhuhuhu
Host	127huhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::↤儁煖숹속ὥ䢰充摢뀊䤚㘶䕮껥㛰䑅羛(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 잰䀓ᒇ频젧䌤œ੠萡ᥤ눬ᜀ�֝ט崨::榷籷�♺蟪ぇ咳鞉䫧샶렭ূ≹度壸兕뗔뮍굣鰓() brfalse.s IL_0040: call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() call System.Boolean 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::핚難➒村�ᙣ��ᢦ�꿭⑅晵朳昖ꉃ筩() brfalse.s IL_0040: call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() call System.Boolean 뚋ꁊ넖瑒瘤룲먕泭뭝ె録襣馌ᑱὝ㩸塎廾峓::get_Exiting() brtrue.s IL_0040: call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() ldsfld 뚋ꁊ넖瑒瘤룲먕泭뭝ె録襣馌ᑱὝ㩸塎廾峓 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::厼룇პ㑄毉䭤麱ڗᓄ룢灏⬆␟덇茇놠;燁 callvirt System.Void 뚋ꁊ넖瑒瘤룲먕泭뭝ె録襣馌ᑱὝ㩸塎廾峓::ᝇᰨ밈ꈳ䰇ݺᰦ蟒㴕ꃊ諅럒蚘墷镱㜳譿䱎棯ꨰ() call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::ꜯ擭뷦젳फ़�⸍筩䑏隱िꮬ㞵⾩춃ퟸ树瓮㚟() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::↤儁煖숹속ὥ䢰充摢뀊䤚㘶䕮껥㛰䑅羛(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 잰䀓ᒇ频젧䌤œ੠萡ᥤ눬ᜀ�֝ט崨::榷籷�♺蟪ぇ咳鞉䫧샶렭ূ≹度壸兕뗔뮍굣鰓() brfalse.s IL_0040: call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() call System.Boolean 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::핚難➒村�ᙣ��ᢦ�꿭⑅晵朳昖ꉃ筩() brfalse.s IL_0040: call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() call System.Boolean 뚋ꁊ넖瑒瘤룲먕泭뭝ె録襣馌ᑱὝ㩸塎廾峓::get_Exiting() brtrue.s IL_0040: call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() ldsfld 뚋ꁊ넖瑒瘤룲먕泭뭝ె録襣馌ᑱὝ㩸塎廾峓 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::厼룇პ㑄毉䭤麱ڗᓄ룢灏⬆␟덇茇놠;燁 callvirt System.Void 뚋ꁊ넖瑒瘤룲먕泭뭝ె録襣馌ᑱὝ㩸塎廾峓::ᝇᰨ밈ꈳ䰇ݺᰦ蟒㴕ꃊ諅럒蚘墷镱㜳譿䱎棯ꨰ() call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::飽됉ﻶẲ瓑ⵉ沱䛓맍匽ﶓ䧽ꗸዉ簶쉾() call System.Void 锐ૻ㘽Ꞟ㢇羸彵늇榈磼⪴뉓ᣭ䮓㽳濘幺ⓚ::ꜯ擭뷦젳फ़�⸍筩䑏隱िꮬ㞵⾩춃ퟸ树瓮㚟() ret <null>

CnC CNCmalicious

127huhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential