QuasarRat PE Executable malware analysis – aae07edd0ecc

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

2 malicious · 2 files

EXEaae07edd0ecc7ce6108afb241d59fa13QuasarRat

EXE[Rebuild from dump]_4740c5d4.exeQuasarRat

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	cGFUWVhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	4huhuhuhu
Host	ef590ohuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	MbFRZrhuhuhuhuhuhuhu
AuthKey	6+llbahuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Offichuhuhuhuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Offihuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	ihuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::겼瓌띜庿�⫸숛肇髄舜榄㩳퀨Ԇ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ᜶Ź꺺ࡽ៲忖堶瓳饙炦덭ထᣖ戮튢⧘�晬::颕쏸ꂼ剶ﻂ쫄⡨艕搕成ꪡ᚞딴⸘��肋麕邶Ђ() brfalse.s IL_0040: call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() call System.Boolean 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::榺톏팲﫠鉏膰좳ᰐ鴅ዓ픠尅왳샊ꗡ丗燤堡瘋() brfalse.s IL_0040: call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() call System.Boolean 氦᥯졇ষ䠇㓡ↇ㮇뒌І᪹�퓶ꀧ䉹שּׁ患떭塞::get_Exiting() brtrue.s IL_0040: call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() ldsfld 氦᥯졇ষ䠇㓡ↇ㮇뒌І᪹�퓶ꀧ䉹שּׁ患떭塞泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::빢씁ᗐᏑ탒诗仭�燳⫽묱䳎ㇶ萘烝煾潩䀡ꟗ callvirt System.Void 氦᥯졇ষ䠇㓡ↇ㮇뒌І᪹�퓶ꀧ䉹שּׁ患떭塞::쇚낄濓䪛쳎沙큧煾纫穏ഇ尜䌤ꉜÀ읲漖ൄႂ痸() call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::�꺊滫씵裪鐈順갇떤䊑㔢ﮊ害ᚅ窯徖♜ণン() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::겼瓌띜庿�⫸숛肇髄舜榄㩳퀨Ԇ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean ᜶Ź꺺ࡽ៲忖堶瓳饙炦덭ထᣖ戮튢⧘�晬::颕쏸ꂼ剶ﻂ쫄⡨艕搕成ꪡ᚞딴⸘��肋麕邶Ђ() brfalse.s IL_0040: call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() call System.Boolean 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::榺톏팲﫠鉏膰좳ᰐ鴅ዓ픠尅왳샊ꗡ丗燤堡瘋() brfalse.s IL_0040: call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() call System.Boolean 氦᥯졇ষ䠇㓡ↇ㮇뒌І᪹�퓶ꀧ䉹שּׁ患떭塞::get_Exiting() brtrue.s IL_0040: call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() ldsfld 氦᥯졇ষ䠇㓡ↇ㮇뒌І᪹�퓶ꀧ䉹שּׁ患떭塞泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::빢씁ᗐᏑ탒诗仭�燳⫽묱䳎ㇶ萘烝煾潩䀡ꟗ callvirt System.Void 氦᥯졇ষ䠇㓡ↇ㮇뒌І᪹�퓶ꀧ䉹שּׁ患떭塞::쇚낄濓䪛쳎沙큧煾纫穏ഇ尜䌤ꉜÀ읲漖ൄႂ痸() call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::餙氻컞譌䌥誚ᲨＢℝ캞麀싥⦚䊁ᏸ㸠쫆䟾曰() call System.Void 泟栌諊ග峒澈＊䔩⯛흟壘㼏耡禽쀳๹⸺光�::�꺊滫씵裪鐈順갇떤䊑㔢ﮊ害ᚅ窯徖♜ণン() ret <null>

CnC CNCmalicious

ef590ohuhuhuhuhuhuhuhuhuhuhu

Port PORTmalicious

4huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential