QuasarRat PE Executable malware analysis – c7c677f4d824

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

High

1 malicious · 28 files

EXEc7c677f4d824b6e894476c265f0c40f7QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version	8Xddu0huhuhuhuhuhuhuhuhuhuhu
Port	aVqVFHhuhuhuhuhuhuhuhuhuhuhu
Host	aVqVFHhuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	9EO5O1huhuhuhuhuhuhuhuhuhuhu
SubDirectory	CVM8thhuhuhuhuhuhuhuhuhuhuhu
InstallName	1huhuhuhu
Install	1huhuhuhu
Startup	Tyw5pThuhuhuhuhuhuhuhuhuhuhu
Mutex	DroFQGhuhuhuhuhuhuhuhuhuhuhu
StartupKey	1huhuhuhu
HideFile	1huhuhuhu
EnableLogger	635123huhuhuhuhuhuhuhuhuhuhu
EncryptionKey	eoqahdhuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client
Full Name	Client
EntryPoint	System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::Main()
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	613
Main Method	System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::Main()
Main IL Instruction Count	21
Main IL	call System.Boolean 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::囅皨䫵ꂺ磷�歝뙩㫡搩铜댣葑馦肗갊ꯇ섳() pop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::⭗澍梭骹�館킦飉꜎︃哬얅஀鮠䀘돨቗啡(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::ﴑ䲗奿㠊읶৆⑲﹑ꗼ欋㲟惛﹊뢿儒ⶆ礚(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 䈕糧ퟅ昫䅙貯鼯븄ᑘꎋ尀㿧쪟ࣉⱷ::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::Main()
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	613
Main Method	System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::Main()
Main IL Instruction Count	21
Main IL	call System.Boolean 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::囅皨䫵ꂺ磷�歝뙩㫡搩铜댣葑馦肗갊ꯇ섳() pop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::⭗澍梭骹�館킦飉꜎︃哬얅஀鮠䀘돨቗啡(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 弱᱅炰婜标ꭾᮬ䐰⋭拒ᔭ忉畄ᦂဣ頕㵏隟斧娴::ﴑ䲗奿㠊읶৆⑲﹑ꗼ欋㲟惛﹊뢿儒ⶆ礚(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 䈕糧ퟅ昫䅙貯鼯븄ᑘꎋ尀㿧쪟ࣉⱷ::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

aVqVFHhuhuhuhuhuhuhuhuhuhuhu

Port PORTmalicious

aVqVFHhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential