QuasarRat PE Executable malware analysis – dd46f6541478

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXEdd46f65414789d6537f7a1fb2384e895QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	8lgR1Ahuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	windohuhuhuhuhuhuhu
Host	windohuhuhuhuhuhuhu
ReconnectDelay	2huhuhuhu
Key	oXCnUihuhuhuhuhuhuhu
AuthKey	h36LUNhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	uhuhuhuhu
InstallName	jsthuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	uphuhuhuhu
HideFile	1huhuhuhu
EnableLogger	1huhuhuhu
Tag	Nhuhuhuhu
LogDirectory	lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	1huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::靻镊繊뫫꘱ꈩɍဨ鿝⣄犍첆䮫৖쟈眔(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 횝陑䇾ǚᆙ䙨꣪崂ټᓵ䭄쀏㳱퀊髤끪粩患넓::᠕踍菈຤욞﷡燿輭ꀐ坩ꎿ꺱慷颋㞊⪵() brfalse.s IL_0040: call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() call System.Boolean ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::疦ᛞ뮲筟ﰗ謜鋵勥帙䑦§䖣ꈙ䕅癈噺穘() brfalse.s IL_0040: call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() call System.Boolean 逽孇㩤쌮�汪佪獌廻꓏낣쮍ᵪ㱼尦㛲挴䥩::get_Exiting() brtrue.s IL_0040: call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() ldsfld 逽孇㩤쌮�汪佪獌廻꓏낣쮍ᵪ㱼尦㛲挴䥩 ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::菼킡遵ꮩ冀৙ਖ਼賨躀㈬᥼樰換䳊櫼렖믭혺 callvirt System.Void 逽孇㩤쌮�汪佪獌廻꓏낣쮍ᵪ㱼尦㛲挴䥩::凍ጌ찙䱑꟰瘐ヷ鹅䞊ꅄ׉뮷렣젓䣌භ炴퐂撁() call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::嬬䒇게ᕋ஌改鼔䅲鵿ሳౙ끭떔ၣ趍⠟뙰䩡욜Ꮑ() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::靻镊繊뫫꘱ꈩɍဨ鿝⣄犍첆䮫৖쟈眔(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 횝陑䇾ǚᆙ䙨꣪崂ټᓵ䭄쀏㳱퀊髤끪粩患넓::᠕踍菈຤욞﷡燿輭ꀐ坩ꎿ꺱慷颋㞊⪵() brfalse.s IL_0040: call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() call System.Boolean ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::疦ᛞ뮲筟ﰗ謜鋵勥帙䑦§䖣ꈙ䕅癈噺穘() brfalse.s IL_0040: call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() call System.Boolean 逽孇㩤쌮�汪佪獌廻꓏낣쮍ᵪ㱼尦㛲挴䥩::get_Exiting() brtrue.s IL_0040: call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() ldsfld 逽孇㩤쌮�汪佪獌廻꓏낣쮍ᵪ㱼尦㛲挴䥩 ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::菼킡遵ꮩ冀৙ਖ਼賨躀㈬᥼樰換䳊櫼렖믭혺 callvirt System.Void 逽孇㩤쌮�汪佪獌廻꓏낣쮍ᵪ㱼尦㛲挴䥩::凍ጌ찙䱑꟰瘐ヷ鹅䞊ꅄ׉뮷렣젓䣌භ炴퐂撁() call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::샷叐কꑩ啣உ鿞⚬攐嚶힉秭ꈔ嗺顱䯈ꀜ厢嚫() call System.Void ֭᳛䷑靄䘱궀렴㭅䎆ᒍ搌突첅፪쉴痘ョ슪귰::嬬䒇게ᕋ஌改鼔䅲鵿ሳౙ끭떔ၣ趍⠟뙰䩡욜Ꮑ() ret <null>

CnC CNCmalicious

windohuhuhuhuhuhuhu

Port PORTmalicious

windohuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential