QuasarRat PE Executable malware analysis – 851fed2e3e6b

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXE851fed2e3e6b2bcb6d6eda04838b3e43QuasarRat

EXE[Rebuild from dump]_944f913e.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	y8NIhkhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	188.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Wihuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::颂ⴼ縠ຍ퐾᢭̫鿡蔉䥙ᓉ⾆ହ澝殕䵍뭷ಌ昹(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 縰ʮ圄ﺴ留ﻍ돪࿤예髟ꀆ懋逦�䭣䒡ኑ჆爸::쇯靧몫�酎䧹늌렾땅웫࿼ᱩ熨ݱ혞᭻➴쎶⭬䓼() brfalse.s IL_0040: call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() call System.Boolean 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::渋᜾弇૜쑮ᷧ钸꾄�쨨㧷ﰯ䲐뉪㫢馢() brfalse.s IL_0040: call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() call System.Boolean 鸋볽莧ﱫᆱ�쟜躹粜ⴆ蓍Ⱗ㗅䎙牜쬖閕::get_Exiting() brtrue.s IL_0040: call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() ldsfld 鸋볽莧ﱫᆱ�쟜躹粜ⴆ蓍Ⱗ㗅䎙牜쬖閕䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::䤊�ẗ켠柄晃蚖_몎榬ځﮨ漘䶀툉 callvirt System.Void 鸋볽莧ﱫᆱ�쟜躹粜ⴆ蓍Ⱗ㗅䎙牜쬖閕::Ḏﺭᯫᴣｇ깊뱃꒣㣓ᕪᚚ䊍쮒ᨦ⿉⎖䃟() call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::⫬墎侧洅뀙黧遧큯릴酨୎츰㋝걘虳탧霿() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::颂ⴼ縠ຍ퐾᢭̫鿡蔉䥙ᓉ⾆ହ澝殕䵍뭷ಌ昹(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 縰ʮ圄ﺴ留ﻍ돪࿤예髟ꀆ懋逦�䭣䒡ኑ჆爸::쇯靧몫�酎䧹늌렾땅웫࿼ᱩ熨ݱ혞᭻➴쎶⭬䓼() brfalse.s IL_0040: call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() call System.Boolean 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::渋᜾弇૜쑮ᷧ钸꾄�쨨㧷ﰯ䲐뉪㫢馢() brfalse.s IL_0040: call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() call System.Boolean 鸋볽莧ﱫᆱ�쟜躹粜ⴆ蓍Ⱗ㗅䎙牜쬖閕::get_Exiting() brtrue.s IL_0040: call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() ldsfld 鸋볽莧ﱫᆱ�쟜躹粜ⴆ蓍Ⱗ㗅䎙牜쬖閕䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::䤊�ẗ켠柄晃蚖_몎榬ځﮨ漘䶀툉 callvirt System.Void 鸋볽莧ﱫᆱ�쟜躹粜ⴆ蓍Ⱗ㗅䎙牜쬖閕::Ḏﺭᯫᴣｇ깊뱃꒣㣓ᕪᚚ䊍쮒ᨦ⿉⎖䃟() call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::봟ᦏ兀锣￰⳶Я␊巄ଃ麙飻᧭腶⻐乣봀ʠⓁ() call System.Void 䏘㱈썻唷�뵨䋝袣驻喙ꎜ癧�팳⦌䄑�퉞먊::⫬墎侧洅뀙黧遧큯릴酨୎츰㋝걘虳탧霿() ret <null>

CnC CNCmalicious

188.huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential