Malicious
Malicious

PE Executable
MD5: edcd27946292c9b5f38e27ee11ae1cf5
Size: 376.84 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 368 KB PE Executable identified by Malva.RE as QuasarRat (rat). Static analysis extracted 5 embedded or derived files and a malware configuration (QuasarRAT config.). It matches 24 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
3414522f84e45aef572ef085bd13fe3d492621635b875981c2fee50ef9741575
MD5
edcd27946292c9b5f38e27ee11ae1cf5
Verdict
Malicious
File type
PE Executable · 368 KB
Family
QuasarRat
Category
RAT

Cite this report: https://app.malva.re/sha256/3414522f84e45aef572ef085bd13fe3d492621635b875981c2fee50ef9741575

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
376.84 KB · 376,844 B
First seen
2025-11-23 00:06 · 11 months ago
Last seen
2025-11-23 00:06 · 11 months ago
Last analysis
2025-11-23 00:08 · 11 months ago
Hashes
MD5 edcd27946292c9b5f38e27ee11ae1cf5 Sha1 f7cd601b916d934964e58701386f246e92bb5201 Sha256 3414522f84e45aef572ef085bd13fe3d492621635b875981c2fee50ef9741575 Sha384 9de22cc7b7cda393ad6da83cf01ff3a46bf5d9ec17b05c6278fd6a6e5d969b955989ebce94b36a28b6657fcde8a08bd9 Sha512 4de967930dd27637c9bc689a98f94ffe19f1a319612f2b17d373dabe0f4d975ca333d74bc9de7feaee91d98fe25e890a30e4605fdd8baae8727c635333cb143c SSDeep 6144:CI6bPXhLApfpvhFQEqLLtfQbAEIJMwmrezwW3jO2:PmhAptYfKIJMwmqzwujO2 TLSH 13848D1377E4E93BD1FE2776E43206190BB0D447B616F38B5B6899B92C223868D417B3
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium

2 malicious · 6 files
EXEedcd27946292c9b5f38e27ee11ae1cf5QuasarRat
EXE[Rebuild from dump]_938800a8.exeQuasarRat
BIN.Net Resources
BINxClient.Properties.Resources.resources
BINinformation
IMG[NBF]root.Data
IMG[NBF]root.Data-preview.png

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key NDg4h4huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host 10huhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey xhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag xhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::᛹橕湹䢯⽾︄磃�姱䇈ᶐ禎⤼ꍥ睻䖓利�笌鿴(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ꉳￖ糪樓ꎋ擾擓퐚䩧૊☔傾♯쪌୙ﺸ͐::�ㆮ衬눳懫뒠兘齎ꆄ᪻᫩‽쵸栀㍵谏쨍佩青()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::ਜ왆镴붊摖韤ⅇ苒汀봝뉦딆낣Ἒ䳵()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::get_Exiting()
brtrue.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
ldsfld �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::䏫﮳猵큛붌麲㾻츧鲂縼陃ᄮࡏ퉤탫뵕旾裍처
callvirt System.Void �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::枰Ćபҕ⎡䄋萤ꨐ鯀寀时킊㶔㓇旻ﭪ덫䱰()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::蘴䏼ք紳跛嶂宎洋ﺌ⮫㱕蛎덐䲂ﳖ�()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::᛹橕湹䢯⽾︄磃�姱䇈ᶐ禎⤼ꍥ睻䖓利�笌鿴(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean ꉳￖ糪樓ꎋ擾擓퐚䩧૊☔傾♯쪌୙ﺸ͐::�ㆮ衬눳懫뒠兘齎ꆄ᪻᫩‽쵸栀㍵谏쨍佩青()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::ਜ왆镴붊摖韤ⅇ苒汀봝뉦딆낣Ἒ䳵()
brfalse.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Boolean �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::get_Exiting()
brtrue.s IL_0040: call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
ldsfld �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::䏫﮳猵큛붌麲㾻츧鲂縼陃ᄮࡏ퉤탫뵕旾裍처
callvirt System.Void �⽑糡郺ۭ竉㺜䓖념묅䛂藛;濛㨧䢃튄::枰Ćபҕ⎡䄋萤ꨐ鯀寀时킊㶔㓇旻ﭪ덫䱰()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::Ѹ猤ꑼ্͟䙎裢㸤ṧ髗ꔌ톊鋼㎃翢䀿䍃()
call System.Void 扪䀀記�ꝴ駴搛ﴡ䉴겶쑾ﺎɌ圳ႃ烩ڃ뛅埩::蘴䏼ք紳跛嶂宎洋ﺌ⮫㱕蛎덐䲂ﳖ�()
ret <null>

CnC CNCmalicious
10huhuhuhu
Port PORTmalicious
4huhuhuhu
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential

2 malicious · 6 files
EXEedcd27946292c9b5f38e27ee11ae1cf5QuasarRat
EXE[Rebuild from dump]_938800a8.exeQuasarRat

Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key NDg4h4huhuhuhuhuhuhu
Version 1.huhuhuhu
Port 4huhuhuhu
Host 10huhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 1huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey xhuhuhuhu
HideFile 1huhuhuhu
EnableLogger 1huhuhuhu
Tag xhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 1huhuhuhu
HideLogSubdirectory 1huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

CnC CNCmalicious
10huhuhuhu
edcd27946292c9b5f38e27ee11ae1cf5
Port PORTmalicious
4huhuhuhu
edcd27946292c9b5f38e27ee11ae1cf5
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
edcd27946292c9b5f38e27ee11ae1cf5
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙