QuasarRat PE Executable malware analysis – f3f27200fdf7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXEf3f27200fdf787c12ac4c8e9ac2b0ab1QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	Ckd2Kuhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	45.1huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::꣡輦ꥆ䇘ꏛ⮷꟎줪ك᫁珂餺⥴ﭰ卄둲잘嶧蟂奫(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 灠ꅤ뽊उ謏ﰭ噴榉쪫޿싿䶧麋ᚁ둠딌닮ܬ::姣䕜躑᧾㝊䋮퉝Ḵ㿍䝆넃㭛ℸ�碷焧ﷀ() brfalse.s IL_0040: call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() call System.Boolean 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::鳱ꑩ濕횒㠋䆖⬈ᛍ̅턟．裢쟳폋檉婣() brfalse.s IL_0040: call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() call System.Boolean 측몎Ｈ냲窹赣宔⢙쿔෰꒱찧싊筱覊齖螜അ晾搵::get_Exiting() brtrue.s IL_0040: call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() ldsfld 측몎Ｈ냲窹赣宔⢙쿔෰꒱찧싊筱覊齖螜അ晾搵覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::鬌紂欎汣蕨�턧긶鬚㏝먘叀ೞ숺尔㐒ပ callvirt System.Void 측몎Ｈ냲窹赣宔⢙쿔෰꒱찧싊筱覊齖螜അ晾搵::�씢胨➖鴞ᇀ䜭戯ⱈ䥑뺸탗蕞愙�쳠ಔ() call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ๅࢗᡀߢ쇌菲빮❻㏲➓铁뜀⬹㩺଄撇뷐ꡚ暓() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::꣡輦ꥆ䇘ꏛ⮷꟎줪ك᫁珂餺⥴ﭰ卄둲잘嶧蟂奫(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 灠ꅤ뽊उ謏ﰭ噴榉쪫޿싿䶧麋ᚁ둠딌닮ܬ::姣䕜躑᧾㝊䋮퉝Ḵ㿍䝆넃㭛ℸ�碷焧ﷀ() brfalse.s IL_0040: call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() call System.Boolean 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::鳱ꑩ濕횒㠋䆖⬈ᛍ̅턟．裢쟳폋檉婣() brfalse.s IL_0040: call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() call System.Boolean 측몎Ｈ냲窹赣宔⢙쿔෰꒱찧싊筱覊齖螜അ晾搵::get_Exiting() brtrue.s IL_0040: call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() ldsfld 측몎Ｈ냲窹赣宔⢙쿔෰꒱찧싊筱覊齖螜അ晾搵覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::鬌紂欎汣蕨�턧긶鬚㏝먘叀ೞ숺尔㐒ပ callvirt System.Void 측몎Ｈ냲窹赣宔⢙쿔෰꒱찧싊筱覊齖螜അ晾搵::�씢胨➖鴞ᇀ䜭戯ⱈ䥑뺸탗蕞愙�쳠ಔ() call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ꂷ蹝㴲ƴŠ䅕䑷枷袡蘿ꜯ䢰⺉ㆃ๞냴彳⊷() call System.Void 覟鏭⦭᧚㖶Β砱滕읢槍֖톅颇䝕�䴇䣑::ๅࢗᡀߢ쇌菲빮❻㏲➓铁뜀⬹㩺଄撇뷐ꡚ暓() ret <null>

CnC CNCmalicious

45.1huhuhuhuhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential