Deep Malware Analysis of dc104d73061e9885e79df21521cb6e17 | md5: dc104d73061e9885e79df21521cb6e17 | RAT | Malicious | QuasarRat | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

1 malicious · 3 files

EXEdc104d73061e9885e79df21521cb6e17QuasarRat

Structure

BINResources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	677BA3huhuhuhuhuhuhuhuhuhuhu
Version	1huhuhuhu
Port
Host	222.2huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
SubDirectory	Wihuhuhuhu
InstallName	Runtihuhuhuhuhuhuhu
Install	1huhuhuhu
Startup	1huhuhuhu
Mutex	7e77dchuhuhuhuhuhuhuhuhuhuhu
StartupKey	Rehuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	BAhuhuhuhu
LogDirectory	dCohuhuhuhu
ServerSignature	BDvmBdhuhuhuhuhuhuhuhuhuhuhu
ServerCertificate	MIIE9Dhuhuhuhuhuhuhuhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	1huhuhuhu
UnattendedMod	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client
Full Name	Client
EntryPoint	System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::焧׉閰⻣⥞켹耑椊삚ꯅ¸쿚㙪伪㏉욺(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::躑譿濭咎⏢黛챂뤒뵽瘟䐐镜マ�憹툪嬲ꉡ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 秂릊鄍졊ꑝ촸锧괪䀑ǽ립╜ॅ뒧涚::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name	Client
Full Name	Client
EntryPoint	System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::Main(System.String[])
Scope Name	Client
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.4.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.5.2
Total Strings	1552
Main Method	System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::Main(System.String[])
Main IL Instruction Count	19
Main IL	ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::焧׉閰⻣⥞켹耑椊삚ꯅ¸쿚㙪伪㏉욺(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 础蓡蘡꩙ᡜ뉦腀蹔뗲猠苺펷䱟蔭딳�팞뗡::躑譿濭咎⏢黛챂뤒뵽瘟䐐镜マ�憹툪嬲ꉡ(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 秂릊鄍졊ꑝ촸锧괪䀑ǽ립╜ॅ뒧涚::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>

CnC CNCmalicious

222.2huhuhuhuhuhuhu

Port PORTmalicious

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential