QuasarRat PE Executable malware analysis – aa2076936452

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXEaa2076936452dba8456557920d9b44d8QuasarRat

EXE[Rebuild from dump]_d78d20a5.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	FKtxNVhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	19ap2huhuhuhuhuhuhu
Host	19ap2huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	nhuhuhuhu
HideFile	1huhuhuhu
EnableLogger	0huhuhuhu
Tag	3rhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::ꐪ﷊ᣙ얡蛫릉噥쯶⮩ꓚ뒽ꦤ긵㫦牼枩号䥜㤜䨕(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 諭ᰤ˂ꑌ蝫겣⼿瞄䔢芯䓄쉲緕趕診抇^蹪::쥥�֟㶅촅졘禳䪋헌郚ꈕ錏䃈ģ㣣ᇗ␂() brfalse.s IL_0040: call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() call System.Boolean 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::䮧᝱烏⿻腊�븮�ﴨꂸ띷⫧熿㊭㷒() brfalse.s IL_0040: call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() call System.Boolean ㎺嘗亜ߌ䶒鈀們瑈㖨勰鮸狤傡໦忮臉뻯琊::get_Exiting() brtrue.s IL_0040: call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() ldsfld ㎺嘗亜ߌ䶒鈀們瑈㖨勰鮸狤傡໦忮臉뻯琊叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::簎阺虽贕覸됬䘺䨿鈨啯붴쟡䧍譖윚 callvirt System.Void ㎺嘗亜ߌ䶒鈀們瑈㖨勰鮸狤傡໦忮臉뻯琊::ᇞ퐥慰퓓⸄ᜆ䏲읰㹑則둈搮䩼煅꽩๝㯁곱刍() call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::読羲⎏ꆛ�窱⻠㽖ꃶ쯓൐噆꿃獓骶᡺ᦢ憓趲() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::ꐪ﷊ᣙ얡蛫릉噥쯶⮩ꓚ뒽ꦤ긵㫦牼枩号䥜㤜䨕(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 諭ᰤ˂ꑌ蝫겣⼿瞄䔢芯䓄쉲緕趕診抇^蹪::쥥�֟㶅촅졘禳䪋헌郚ꈕ錏䃈ģ㣣ᇗ␂() brfalse.s IL_0040: call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() call System.Boolean 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::䮧᝱烏⿻腊�븮�ﴨꂸ띷⫧熿㊭㷒() brfalse.s IL_0040: call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() call System.Boolean ㎺嘗亜ߌ䶒鈀們瑈㖨勰鮸狤傡໦忮臉뻯琊::get_Exiting() brtrue.s IL_0040: call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() ldsfld ㎺嘗亜ߌ䶒鈀們瑈㖨勰鮸狤傡໦忮臉뻯琊叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::簎阺虽贕覸됬䘺䨿鈨啯붴쟡䧍譖윚 callvirt System.Void ㎺嘗亜ߌ䶒鈀們瑈㖨勰鮸狤傡໦忮臉뻯琊::ᇞ퐥慰퓓⸄ᜆ䏲읰㹑則둈搮䩼煅꽩๝㯁곱刍() call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::씞鿈讚肃貞弡ꀜ釶憓ヶ吠�哬ൠ㢯沂远邈() call System.Void 叭✧텤眠픁蔲渏䗠౵￰�⟝勏ቃ�蔁곐㧁ầ::読羲⎏ꆛ�窱⻠㽖ꃶ쯓൐噆꿃獓骶᡺ᦢ憓趲() ret <null>

CnC CNCmalicious

19ap2huhuhuhuhuhuhu

Port PORTmalicious

19ap2huhuhuhuhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential