QuasarRat PE Executable malware analysis – c509119d0f7e

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

Microsoft Visual C# / Basic .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXEc509119d0f7e80c77bd41f8aefd9d3b7QuasarRat

EXE[Rebuild from dump]_fb74c5df.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	eE35Dyhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	6huhuhuhu
Host	172.huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	3huhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::﹤沆婫葲岷ᰂ뾊ᇶ硫ឞ腡볗騵촢嚎莂쐱Ể(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 赐ꄧᥒ엌ᷥໝ䗱׬⒪橛橩垫ꯣ뱔㄄䓋⎨▰ഊ脖::﫵薥륀╢뛨㘳Ẩ捜쳝鿀摂淩鮶ᑾ됤⻈鮻쓃Ꭹ() brfalse.s IL_0040: call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() call System.Boolean ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::홋硯�㮦獟졚ߘ䎇�렅㞋ਐꈦ縓㑾㹂폺() brfalse.s IL_0040: call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() call System.Boolean �쌤駈᫠�梊鶊烢␽ᢔ﬑ో蠖ᡞ⤛ῙŅᅋ::get_Exiting() brtrue.s IL_0040: call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() ldsfld �쌤駈᫠�梊鶊烢␽ᢔ﬑ో蠖ᡞ⤛ῙŅᅋ ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::度ᨱ㒆᭮꽮㨼䁯驻ꛆ犹鐣舶磡瓫莀䞆䄨ፐ嬀 callvirt System.Void �쌤駈᫠�梊鶊烢␽ᢔ﬑ో蠖ᡞ⤛ῙŅᅋ::腜ˮ峘퓻猚硫⢽펦ꐇ⨒斖阒㏩뺄罡夌긍헁() call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::ᴍ㯯嘜쥕氊ᰪ뱮㴺끠Ⱶᙃ쪉먯卙뽤樅呷࿥㑚() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::﹤沆婫葲岷ᰂ뾊ᇶ硫ឞ腡볗騵촢嚎莂쐱Ể(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 赐ꄧᥒ엌ᷥໝ䗱׬⒪橛橩垫ꯣ뱔㄄䓋⎨▰ഊ脖::﫵薥륀╢뛨㘳Ẩ捜쳝鿀摂淩鮶ᑾ됤⻈鮻쓃Ꭹ() brfalse.s IL_0040: call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() call System.Boolean ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::홋硯�㮦獟졚ߘ䎇�렅㞋ਐꈦ縓㑾㹂폺() brfalse.s IL_0040: call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() call System.Boolean �쌤駈᫠�梊鶊烢␽ᢔ﬑ో蠖ᡞ⤛ῙŅᅋ::get_Exiting() brtrue.s IL_0040: call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() ldsfld �쌤駈᫠�梊鶊烢␽ᢔ﬑ో蠖ᡞ⤛ῙŅᅋ ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::度ᨱ㒆᭮꽮㨼䁯驻ꛆ犹鐣舶磡瓫莀䞆䄨ፐ嬀 callvirt System.Void �쌤駈᫠�梊鶊烢␽ᢔ﬑ో蠖ᡞ⤛ῙŅᅋ::腜ˮ峘퓻猚硫⢽펦ꐇ⨒斖阒㏩뺄罡夌긍헁() call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::敠突煦녞뜠깨燋⒋ᒫꏙ뜮⠞⽗돆겭킮䟬錛() call System.Void ᤶ鵁굱㳑뉊▍锅鉢昐꼠癑표넋됸宖ʭ⹩荓::ᴍ㯯嘜쥕氊ᰪ뱮㴺끠Ⱶᙃ쪉먯卙뽤樅呷࿥㑚() ret <null>

CnC CNCmalicious

172.huhuhuhuhuhuhu

Port PORTmalicious

6huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential