QuasarRat PE Executable malware analysis – d104fd332940

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXEd104fd33294068d25672b6c6964c0b32QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	Kt5tujhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	7.tcphuhuhuhuhuhuhu
Host	7.tcphuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	svhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Sİhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::턑ቧ媄쾲⢲ݐ吟ẙꌵꞅ넝�脁悾꜐(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 鵰釦魘잞܏ⷼ䊫�嫔噞ー嶘摏믅�銻Vਇ::팂퓣昅શ댥㋖ᶃ냽戚돨솷暞䶿錗輶돏() brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() call System.Boolean 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::✊ᎍ：㰾滺ꊿ䓨熯蚔挌덦쿄ꄺ찈䬯櫈粸() brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() call System.Boolean ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::get_Exiting() brtrue.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() ldsfld ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴ 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::펵髟팶፜域ૺ�붒䋨䢙ᡡ牝ᇻ烆枘풥Ԍ褊 callvirt System.Void ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::嚹๨񧎥ꮣ밦綆ፒ벂偝ᵜ徒ὃ窄ਗ਼壧Օ똺㛝ꌛ() call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::殠쵳悃憴淣ㆭ䔃뷖㏥ᨇ఩꿠᫹䒻ొꆼᦽ() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::턑ቧ媄쾲⢲ݐ吟ẙꌵꞅ넝�脁悾꜐(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 鵰釦魘잞܏ⷼ䊫�嫔噞ー嶘摏믅�銻Vਇ::팂퓣昅શ댥㋖ᶃ냽戚돨솷暞䶿錗輶돏() brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() call System.Boolean 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::✊ᎍ：㰾滺ꊿ䓨熯蚔挌덦쿄ꄺ찈䬯櫈粸() brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() call System.Boolean ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::get_Exiting() brtrue.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() ldsfld ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴ 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::펵髟팶፜域ૺ�붒䋨䢙ᡡ牝ᇻ烆枘풥Ԍ褊 callvirt System.Void ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::嚹๨񧎥ꮣ밦綆ፒ벂偝ᵜ徒ὃ窄ਗ਼壧Օ똺㛝ꌛ() call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ() call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::殠쵳悃憴淣ㆭ䔃뷖㏥ᨇ఩꿠᫹䒻ొꆼᦽ() ret <null>

CnC CNCmalicious

7.tcphuhuhuhuhuhuhu

Port PORTmalicious

7.tcphuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential