QuasarRat PE Executable malware analysis – 8bbcee0f4772

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE8bbcee0f4772cfce612db34c9b503d7bQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	61G2JQhuhuhuhuhuhuhu
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Port	crahuhuhuhu
Host	crahuhuhuhu
Conf. AES-Key	61G2JQhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	stopmhuhuhuhuhuhuhu
ReconnectDelay	5huhuhuhu
Key	zazLGUhuhuhuhuhuhuhu
AuthKey	Cpfpq0huhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	0PHmXhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	vmhuhuhuhu
LogDirectory	mihuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::된硒괦Ҝ姵�縩䁕ቭ菚ᕊᇘհ⥲得�ݧ냘(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 儲믢晆炯ᴻ接ﴨ扃៏⥄佒湴币퇯ﭣ杳ⱆ鏹::ﾅ璸っ繼ở⌲卜怲阧ꮮ⢽⭈룢矷柳썞눫헹() brfalse.s IL_0040: call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() call System.Boolean ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::륤夎ᅘ㣔ᠯ흢姠�啩㭻橼䆝椏և꽜ꑋひ() brfalse.s IL_0040: call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() call System.Boolean 꺹릹캓᠒̪᠍뤃䰬�憒ꠁ믱鞽㵛㨉�ᜡ꿻肿::get_Exiting() brtrue.s IL_0040: call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() ldsfld 꺹릹캓᠒̪᠍뤃䰬�憒ꠁ믱鞽㵛㨉�ᜡ꿻肿 ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::㯐恈⺮븍ꖕ抰鞬⠟ⶤ己ᛡﵞﻵẓ뙱⹰焙̴搃 callvirt System.Void 꺹릹캓᠒̪᠍뤃䰬�憒ꠁ믱鞽㵛㨉�ᜡ꿻肿::⩟삙榞煾귪妊埒넺朁鳼䃦볘䍼樛㺜㢵穛䦔() call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::ࡳᵚⲏ咡ඹ᝿塮ら燶哆鄪찵⮄퓠翁皇() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::된硒괦Ҝ姵�縩䁕ቭ菚ᕊᇘհ⥲得�ݧ냘(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 儲믢晆炯ᴻ接ﴨ扃៏⥄佒湴币퇯ﭣ杳ⱆ鏹::ﾅ璸っ繼ở⌲卜怲阧ꮮ⢽⭈룢矷柳썞눫헹() brfalse.s IL_0040: call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() call System.Boolean ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::륤夎ᅘ㣔ᠯ흢姠�啩㭻橼䆝椏և꽜ꑋひ() brfalse.s IL_0040: call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() call System.Boolean 꺹릹캓᠒̪᠍뤃䰬�憒ꠁ믱鞽㵛㨉�ᜡ꿻肿::get_Exiting() brtrue.s IL_0040: call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() ldsfld 꺹릹캓᠒̪᠍뤃䰬�憒ꠁ믱鞽㵛㨉�ᜡ꿻肿 ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::㯐恈⺮븍ꖕ抰鞬⠟ⶤ己ᛡﵞﻵẓ뙱⹰焙̴搃 callvirt System.Void 꺹릹캓᠒̪᠍뤃䰬�憒ꠁ믱鞽㵛㨉�ᜡ꿻肿::⩟삙榞煾귪妊埒넺朁鳼䃦볘䍼樛㺜㢵穛䦔() call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::쀟풐ᆧ㔒꩹裶돣쀹⌚�ꔐ㒦❑쾆⮫劖퓥�弇톥() call System.Void ꡺�엔ང嵅෹K曥駶奜鴶샏⎉䰧뒉ࣣᕁ::ࡳᵚⲏ咡ඹ᝿塮ら燶哆鄪찵⮄퓠翁皇() ret <null>

CnC CNCmalicious

stopmhuhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

CnC CNCmalicious

crahuhuhuhu

Port PORTmalicious

crahuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential