QuasarRat PE Executable malware analysis – 8565b61695a5

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXE8565b61695a5b606f2ef2ea30bfdcd0dQuasarRat

EXE[Rebuild from dump]_461e454a.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	xGb5fHhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	104.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	1huhuhuhu
EnableLogger	0huhuhuhu
Tag	Ohuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::鿖ꪘ⳸掴铠壬夳觇䪩狅晵叾裔䦯峥�ύᅊ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 㳯컞ꃤᆎ꿧鰍珈됳౫ꑸ鹶휇㿮﷬뇯::ꂁ⣳珮紿蒳䐍�䜾粩�䩰纴ڠ㰷㦸ꍆŕ() brfalse.s IL_0040: call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() call System.Boolean ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﻉⵛ兏鐛叿珇ᢈ庂䢐涘蛎쐼蘰坥䌌ﻟﶖ() brfalse.s IL_0040: call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() call System.Boolean 屢띛걽僁볡▻곹놑蘄ꁹ巎�ᐐ┙䇹絆魁떴ܦ::get_Exiting() brtrue.s IL_0040: call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() ldsfld 屢띛걽僁볡▻곹놑蘄ꁹ巎�ᐐ┙䇹絆魁떴ܦ ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::败稀洞귍�䍌걬扱焅唗잕ꠗ莏옫㋈譂콲芟⳽ callvirt System.Void 屢띛걽僁볡▻곹놑蘄ꁹ巎�ᐐ┙䇹絆魁떴ܦ::臋≇㺢ꮺ﫢�Ɽ혓鴣悃쵔횪捚傑탷뼍걁() call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::廩㧨䟍聞ꪖ䡝䇨썒ꌏ綮⿇᛿갺奸帝鏆⛕亴꒺() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::鿖ꪘ⳸掴铠壬夳觇䪩狅晵叾裔䦯峥�ύᅊ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 㳯컞ꃤᆎ꿧鰍珈됳౫ꑸ鹶휇㿮﷬뇯::ꂁ⣳珮紿蒳䐍�䜾粩�䩰纴ڠ㰷㦸ꍆŕ() brfalse.s IL_0040: call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() call System.Boolean ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﻉⵛ兏鐛叿珇ᢈ庂䢐涘蛎쐼蘰坥䌌ﻟﶖ() brfalse.s IL_0040: call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() call System.Boolean 屢띛걽僁볡▻곹놑蘄ꁹ巎�ᐐ┙䇹絆魁떴ܦ::get_Exiting() brtrue.s IL_0040: call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() ldsfld 屢띛걽僁볡▻곹놑蘄ꁹ巎�ᐐ┙䇹絆魁떴ܦ ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::败稀洞귍�䍌걬扱焅唗잕ꠗ莏옫㋈譂콲芟⳽ callvirt System.Void 屢띛걽僁볡▻곹놑蘄ꁹ巎�ᐐ┙䇹絆魁떴ܦ::臋≇㺢ꮺ﫢�Ɽ혓鴣悃쵔횪捚傑탷뼍걁() call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::ﴏ퐞ጴ�虶⬣觰詟ځ鎸() call System.Void ⮧诌蚍杭‱퀑馓᥁呏౾墟氲㮌ꍸ탸蟘隐쐻ᵴ୎::廩㧨䟍聞ꪖ䡝䇨썒ꌏ綮⿇᛿갺奸帝鏆⛕亴꒺() ret <null>

CnC CNCmalicious

104.huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential