QuasarRat PE Executable malware analysis – 861136de95d7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

2 malicious · 2 files

EXE861136de95d7f2e87836997cd08edcd7AsyncRAT

EXE[Rebuild from dump]_3db5d15d.exeAsyncRAT

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	07ACADhuhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port	2huhuhuhu
Host	ensurehuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	e0b8b8huhuhuhuhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
ServerSignature	QJKz5Ahuhuhuhuhuhuhuhuhuhuhu
ServerCertificate	MIIFEzhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu
UnattendedMod	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Key (AES_256)	-huhuhuhu
Pastebin	-huhuhuhu
ServerSignature	p8X48Whuhuhuhuhuhuhuhuhuhuhu
Install File	Sbihuhuhuhu
Mutex	cmdvhuhuhuhu
Group	cmdvhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	2280
Main Method	System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::䤩鲽剓ጛ죶䨸Ť蒘甗ﹻ해￹뵩⨑�裡툻꤅脚(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::穰ᵦඐ雋ቬ偐½⏝鋮缄⌜ҕ雧촞(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 踖氾⣫ﮤ趋ՠ䡺➽ٮ�裱녗澬꭫䐥영꫈ힴ䴊绞::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	2280
Main Method	System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::䤩鲽剓ጛ죶䨸Ť蒘甗ﹻ해￹뵩⨑�裡툻꤅脚(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 㤁䉛မ쥘垍ꃧ㐀煻ꍸ鸘ﰟ䒏਒س▲事议堟裡::穰ᵦඐ雋ቬ偐½⏝鋮缄⌜ҕ雧촞(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 踖氾⣫ﮤ趋ՠ䡺➽ٮ�裱녗澬꭫䐥영꫈ힴ䴊绞::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

ensurehuhuhuhuhuhuhuhuhuhuhu

Port PORTmalicious

2huhuhuhu

Key (AES_256) MUTEXmalicious

-huhuhuhu

Mutex MUTEXmalicious

cmdvhuhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential