QuasarRat PE Executable malware analysis – 8bef9a2dd87e

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXE8bef9a2dd87e19ad863726fe3b33bf0cQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	qMha1shuhuhuhuhuhuhu
Version	1.huhuhuhu
Port
Host	213.1huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	syhuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Clhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::紈齚�呌䷙丬嶊汛㡚�㣚䑍탴℃쭼⡴䇗䌓햍(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 骘䒟酫ꭣᧅ삧샂촶淦醨ꉦ鴳螱翙쎓궹投::蠡霵ﰆ轡糬ἓ金⽯ㅕ�뭀᭘禹琺퉪⏿阄㾉濱() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::⪢餻ꡃ孌纺岚꟡滽淣ؔ㉨率ᖯ肳⩊弔() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::get_Exiting() brtrue.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() ldsfld 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯 ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::덕⍴や꠳ꁘ敁扡阗䋿氒璿︱ꍈꊛỏȒ䝓葸 callvirt System.Void 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::메쮪ᾎ�鷺鞪擼ٷ婢䰽亊챡膚֘宷襺�() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Ꮢ趘䄐力씄읣黓ꩅ倸쪦㨢�捯씳ᡰ⪯�榃鈬⬟() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::紈齚�呌䷙丬嶊汛㡚�㣚䑍탴℃쭼⡴䇗䌓햍(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 骘䒟酫ꭣᧅ삧샂촶淦醨ꉦ鴳螱翙쎓궹投::蠡霵ﰆ轡糬ἓ金⽯ㅕ�뭀᭘禹琺퉪⏿阄㾉濱() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::⪢餻ꡃ孌纺岚꟡滽淣ؔ㉨率ᖯ肳⩊弔() brfalse.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Boolean 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::get_Exiting() brtrue.s IL_0040: call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() ldsfld 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯 ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::덕⍴や꠳ꁘ敁扡阗䋿氒璿︱ꍈꊛỏȒ䝓葸 callvirt System.Void 헳瀾ᨬ皺嚹눕퀯☀푨깞幀頞οᕕ珞孻൜㿯::메쮪ᾎ�鷺鞪擼ٷ婢䰽亊챡膚֘宷襺�() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::贙瞅ᡞ픓쬔董ゖ砄펶ꅾ�墡蹈뱙韁菛㉫() call System.Void ᝉ▏趝뾐툕䳭耐읻⼵溑촁㯲嗰嬭ᡶ阙捂ⷲ⽤::Ꮢ趘䄐力씄읣黓ꩅ倸쪦㨢�捯씳ᡰ⪯�榃鈬⬟() ret <null>

CnC CNCmalicious

213.1huhuhuhuhuhuhu

Port PORTmalicious

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential