QuasarRat PowerShell malware analysis – f304c001ba73

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Type

PowerShell Script

3 malicious · 30 files

PS1f304c001ba733ced1a3b213dcf2d1ba0QuasarRat

GZ[Base64-Block]QuasarRat

EXEfile_0.binQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key
Version	D3bT5nhuhuhuhuhuhuhuhuhuhuhu
Port	NZlG5ehuhuhuhuhuhuhuhuhuhuhu
Host	NZlG5ehuhuhuhuhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	g8/TLHhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	g/E4ZDhuhuhuhuhuhuhuhuhuhuhu
InstallName	1huhuhuhu
Install	1huhuhuhu
Startup	ciDXSwhuhuhuhuhuhuhuhuhuhuhu
Mutex	aQ4h7qhuhuhuhuhuhuhuhuhuhuhu
StartupKey	0huhuhuhu
HideFile	1huhuhuhu
EnableLogger	6B58BFhuhuhuhuhuhuhuhuhuhuhu
EncryptionKey	pSmwbmhuhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

CnC CNCmalicious

NZlG5ehuhuhuhuhuhuhuhuhuhuhu

Port PORTmalicious

NZlG5ehuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.