QuasarRat PE Executable malware analysis – 8bc013160433

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE8bc01316043358e3d72ddfd63b51641cQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	vKICUXhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	4huhuhuhu
Host	127huhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey	Quasarhuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	auhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::䅾ᮘ埾郹ࢺ吊ᩝぃբ퍵漫간꺔ࢋ蕐裉鉫(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 䟚㌬ꏘ圅곪ࣧ쎑盘ꪾ劎뚲厱疄๞쒭趗::ퟙ濯쏅竢ꆖ짉へ롥랐봝䋶魹엨寢() brfalse.s IL_0040: call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() call System.Boolean ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::ᔚ沾頹㻗铑ᅽ�큘蓦䬥柃ⱱ效핰⁉넭렟() brfalse.s IL_0040: call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() call System.Boolean ƪ缐�ꚉ䲚譚Ⴝ壒맣㐻熕໱묙☇걫酡犫::get_Exiting() brtrue.s IL_0040: call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() ldsfld ƪ缐�ꚉ䲚譚Ⴝ壒맣㐻熕໱묙☇걫酡犫 ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::⼔➯⊆ⳏ虤嬖׫╄࿠路码꺶឵ﯧﺖ삯 callvirt System.Void ƪ缐�ꚉ䲚譚Ⴝ壒맣㐻熕໱묙☇걫酡犫::晏⢀蕞흉䖈赂鸷檲礦�☏떌룗¢┈佉�膃㰔() call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::༳ꃳ帴馣薚ꃥ簾ﹲﭳ᜚ᦇ焦鮣�䝝瑻亼韪鬗() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::䅾ᮘ埾郹ࢺ吊ᩝぃբ퍵漫간꺔ࢋ蕐裉鉫(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 䟚㌬ꏘ圅곪ࣧ쎑盘ꪾ劎뚲厱疄๞쒭趗::ퟙ濯쏅竢ꆖ짉へ롥랐봝䋶魹엨寢() brfalse.s IL_0040: call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() call System.Boolean ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::ᔚ沾頹㻗铑ᅽ�큘蓦䬥柃ⱱ效핰⁉넭렟() brfalse.s IL_0040: call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() call System.Boolean ƪ缐�ꚉ䲚譚Ⴝ壒맣㐻熕໱묙☇걫酡犫::get_Exiting() brtrue.s IL_0040: call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() ldsfld ƪ缐�ꚉ䲚譚Ⴝ壒맣㐻熕໱묙☇걫酡犫 ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::⼔➯⊆ⳏ虤嬖׫╄࿠路码꺶឵ﯧﺖ삯 callvirt System.Void ƪ缐�ꚉ䲚譚Ⴝ壒맣㐻熕໱묙☇걫酡犫::晏⢀蕞흉䖈赂鸷檲礦�☏떌룗¢┈佉�膃㰔() call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::孲ࡴŋᕚᒳႨ☯͕샿�ꝸᩮ㌻晙擃᠟㎝朊() call System.Void ꪙ읫ﻮ⵼崾媊埃룶湟ﰆⰠ녨ﮭ㭡᧞ܚꀺ䄎::༳ꃳ帴馣薚ꃥ簾ﹲﭳ᜚ᦇ焦鮣�䝝瑻亼韪鬗() ret <null>

CnC CNCmalicious

127huhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential