QuasarRat PE Executable malware analysis – e9ee98884693

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

2 malicious · 6 files

EXEe9ee98884693a0f7b1e123bd39d3eb81QuasarRat

EXE[Rebuild from dump]_ec386a74.exeQuasarRat

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	JTis9uhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	85.huhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	1huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::႕Ⓘ悩ጼ䙳塢懶眎护๯�緔杰쎒揊徥ꗢ�㊫(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 呜魠溊甅锧괫⩭㝰㛤⵺Ꮣ콂竸끓�∣㰨�㨚::䂋͊余䲇㰹핧쭖翉焵᯶烪陶酄輗臨ꦴ‡㯆�() brfalse.s IL_0040: call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() call System.Boolean 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::贜뻔脟ࣄ묫뚧讘持ꬻ폫渡쒳툙긐㯈梾橁() brfalse.s IL_0040: call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() call System.Boolean 爂ぉ숅廀ᥛ鯒鵙२ႇ랢ⵕᛆᔩ痾߈㢕ﴣ✢암::get_Exiting() brtrue.s IL_0040: call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() ldsfld 爂ぉ숅廀ᥛ鯒鵙२ႇ랢ⵕᛆᔩ痾߈㢕ﴣ✢암 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::糊鮙徰댴龰蹘�薺魈༾ꡎ⤈⦝ີ钰ჵ曵 callvirt System.Void 爂ぉ숅廀ᥛ鯒鵙२ႇ랢ⵕᛆᔩ痾߈㢕ﴣ✢암::푅珮ᐖᇂ鶷膧㎾菔崟脿⦑�㻇ⵉ榑左ฦ쬙() call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::î멚왰沟㭡怉ᨡ࿇뜺⫰接ৱ튪쁵梻骸㜾ₚ臣() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::႕Ⓘ悩ጼ䙳塢懶眎护๯�緔杰쎒揊徥ꗢ�㊫(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 呜魠溊甅锧괫⩭㝰㛤⵺Ꮣ콂竸끓�∣㰨�㨚::䂋͊余䲇㰹핧쭖翉焵᯶烪陶酄輗臨ꦴ‡㯆�() brfalse.s IL_0040: call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() call System.Boolean 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::贜뻔脟ࣄ묫뚧讘持ꬻ폫渡쒳툙긐㯈梾橁() brfalse.s IL_0040: call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() call System.Boolean 爂ぉ숅廀ᥛ鯒鵙२ႇ랢ⵕᛆᔩ痾߈㢕ﴣ✢암::get_Exiting() brtrue.s IL_0040: call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() ldsfld 爂ぉ숅廀ᥛ鯒鵙२ႇ랢ⵕᛆᔩ痾߈㢕ﴣ✢암 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::糊鮙徰댴龰蹘�薺魈༾ꡎ⤈⦝ີ钰ჵ曵 callvirt System.Void 爂ぉ숅廀ᥛ鯒鵙२ႇ랢ⵕᛆᔩ痾߈㢕ﴣ✢암::푅珮ᐖᇂ鶷膧㎾菔崟脿⦑�㻇ⵉ榑左ฦ쬙() call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::腡롉鑉�烐숚걬麤㮜縉拄⟬㏻竽ᗘ뇂鍭ࣹ() call System.Void 鉥뷒䔑�ݝꯙ늴ﮬ骇毩奄笳᫢::î멚왰沟㭡怉ᨡ࿇뜺⫰接ৱ튪쁵梻骸㜾ₚ臣() ret <null>

CnC CNCmalicious

85.huhuhuhu

Port PORTmalicious

1huhuhuhu

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential