QuasarRat PE Executable malware analysis – cc91dab1f931

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXEcc91dab1f9313e694198b3d7f3c704dfQuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	8Ku26dhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	37.2huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Ashuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::푖묻㽭桱鲦䨐顫捱湞ꫭ휯餹럵Ꟗ馘鎉੹㯳(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 틞�순駕῁͜䥮踹珈ꬦ텠浔쇜宎῿媚怘::皸ⰻ擌�㪹눛鷞佮蛀ꆁ悅姣뿑Ꝣ쓳궿棛齾࿚() brfalse.s IL_0040: call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() call System.Boolean ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::客삪￰⿐ꢳ౫옛辟�㤃䅕�ῡꮛ䒤璏⸩蟌() brfalse.s IL_0040: call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() call System.Boolean ᵂ᝺㎶閛錄䖨곕驋횢䥉쵻Ḑ薗梈⭊䙹匪�::get_Exiting() brtrue.s IL_0040: call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() ldsfld ᵂ᝺㎶閛錄䖨곕驋횢䥉쵻Ḑ薗梈⭊䙹匪� ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::Ⲯꜿƺ斷㷣�穰䙮顳�᠋遅簕诺Ᏹ㔄햱蔊 callvirt System.Void ᵂ᝺㎶閛錄䖨곕驋횢䥉쵻Ḑ薗梈⭊䙹匪�::₻틡喼⪫藗뵛펆낯ኽ䙶⫹⤋䜗ᆙⷳꈭ掮() call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::葯蹝竷⿹�㏍䑑ꯞ秠僉檞戣뎜㥎箍਋秪߼⣰땛() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::푖묻㽭桱鲦䨐顫捱湞ꫭ휯餹럵Ꟗ馘鎉੹㯳(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 틞�순駕῁͜䥮踹珈ꬦ텠浔쇜宎῿媚怘::皸ⰻ擌�㪹눛鷞佮蛀ꆁ悅姣뿑Ꝣ쓳궿棛齾࿚() brfalse.s IL_0040: call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() call System.Boolean ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::客삪￰⿐ꢳ౫옛辟�㤃䅕�ῡꮛ䒤璏⸩蟌() brfalse.s IL_0040: call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() call System.Boolean ᵂ᝺㎶閛錄䖨곕驋횢䥉쵻Ḑ薗梈⭊䙹匪�::get_Exiting() brtrue.s IL_0040: call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() ldsfld ᵂ᝺㎶閛錄䖨곕驋횢䥉쵻Ḑ薗梈⭊䙹匪� ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::Ⲯꜿƺ斷㷣�穰䙮顳�᠋遅簕诺Ᏹ㔄햱蔊 callvirt System.Void ᵂ᝺㎶閛錄䖨곕驋횢䥉쵻Ḑ薗梈⭊䙹匪�::₻틡喼⪫藗뵛펆낯ኽ䙶⫹⤋䜗ᆙⷳꈭ掮() call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::㖱짺灎வ㠿ૄጤ㰇Ợ铗饪掊윎ﵨួ❚焲曝䋟畣() call System.Void ꞧ묒옺儤❳﬛艰ʇ቏⥐ᒻἫ纏韋역跡َ::葯蹝竷⿹�㏍䑑ꯞ秠僉檞戣뎜㥎箍਋秪߼⣰땛() ret <null>

CnC CNCmalicious

37.2huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential