QuasarRat PE Executable malware analysis – feec3cf0f428

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

HTML file

Size

2.03 MB · 2,027,008 B

First seen

2026-03-17 15:46 · 7 months ago

Last seen

2026-03-17 15:46 · 7 months ago

Last analysis

2026-03-17 15:51 · 7 months ago

Hashes

MD5 a7ee0066dd2cf11a38226709c76c314d Sha1 8370e6f71a2dea8dbdf739a549f740c98153246f Sha256 feec3cf0f4281220ada2bb20bd59a3254e7543d65631a4a0deae019ffc15d277 Sha384 ccc763ccfb6ee1bc58cad8d6503218383a50b43ea8e5901ef211fcfe1b7e9a9cacab592a876d0c89f300946826e85a00 Sha512 99c34a5b29e90383e7b3af00cae219d7858d2a85b8b55f490facc38eda3931a0298c2a377c3696dee2cf5a76f974e68f4261f9336f03860f67ecffaa4f35a2f4 SSDeep 49152:DcSNWnn7wRPirm2NnPTKKm77LrwCB6uanKy:DR0MoZNn2Km77LrwkFW TLSH 7395F050B7F6811AF2FF6BB9A8B718490B37B903EA36D74E0888605D1EB77409D51363

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 103 files

EXEa7ee0066dd2cf11a38226709c76c314dQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version	Objehuhuhuhu
Port	Chainhuhuhuhuhuhuhu
Host	Chainhuhuhuhuhuhuhu
ReconnectDelay	Authhuhuhuhuhuhuhu
Key	Chaihuhuhuhu
SubDirectory	Keyhuhuhuhu
InstallName	Ahuhuhuhu
Install	Microshuhuhuhuhuhuhuhuhuhuhu
Startup	1huhuhuhu
Mutex	1huhuhuhu
StartupKey	-10huhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
EncryptionKey	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PDB Path: ?
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.5.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	2163
Main Method	System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::P4IR11k3clAOGvo51PAc() newobj System.Void knmcswnvpcyvlx.MmxmNfU4DhHL8Y8a::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.6.5.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	2163
Main Method	System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::Main()
Main IL Instruction Count	11
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.Void knmcswnvpcyvlx.PgkLgUskaheb7QOSRn::P4IR11k3clAOGvo51PAc() newobj System.Void knmcswnvpcyvlx.MmxmNfU4DhHL8Y8a::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

Chainhuhuhuhuhuhuhu

Port PORTmalicious

Chainhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential