QuasarRat PE Executable malware analysis – fc21a43b07bc

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXEfc21a43b07bcde3cf36f359e3c9ec75fQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	oUR3qnhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port
Host	193.1huhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	Suhuhuhuhu
InstallName	Clihuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Quasahuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	Ofhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	1huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::꠆Ḩᔸᄘ셋롲樠⸿す⁯衧氷ړ誦׳ᵐ땖⻭(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 旅辵춐ﻡ땩䛴鏜忽첐껵뫴▲㍅캐㓉搪商왼::䳏魻齇�넨쟾뷾ᬙ뫶銢遫،䮩䌵�䕬‧ϩ() brfalse.s IL_0040: call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() call System.Boolean ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::쾦賹㴔暙ږ냵聯葞刐᱿鰫䏼咫櫬悃Ꮄ戚() brfalse.s IL_0040: call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() call System.Boolean 큩硂⁹禳踆薱沕⦶ᰢ뻋熅ꌒӋ醯㘀䃂ዙ吐::get_Exiting() brtrue.s IL_0040: call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() ldsfld 큩硂⁹禳踆薱沕⦶ᰢ뻋熅ꌒӋ醯㘀䃂ዙ吐 ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::烘╗獓鿶ﬡI쓢ꭘ攬㻉ꋢ䭆㪵ﰯ慷䄛ᓇ callvirt System.Void 큩硂⁹禳踆薱沕⦶ᰢ뻋熅ꌒӋ醯㘀䃂ዙ吐::铠飷퓃馯䢨ꩂ瀃鐞丒ⲭ逈筷穅灒坓䨴驜롱꿉() call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::噰潒ƛ孵噌⣣荺Ⓚ⯩䉖메쨲系혊쑉묾笐䍶놀() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::꠆Ḩᔸᄘ셋롲樠⸿す⁯衧氷ړ誦׳ᵐ땖⻭(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 旅辵춐ﻡ땩䛴鏜忽첐껵뫴▲㍅캐㓉搪商왼::䳏魻齇�넨쟾뷾ᬙ뫶銢遫،䮩䌵�䕬‧ϩ() brfalse.s IL_0040: call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() call System.Boolean ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::쾦賹㴔暙ږ냵聯葞刐᱿鰫䏼咫櫬悃Ꮄ戚() brfalse.s IL_0040: call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() call System.Boolean 큩硂⁹禳踆薱沕⦶ᰢ뻋熅ꌒӋ醯㘀䃂ዙ吐::get_Exiting() brtrue.s IL_0040: call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() ldsfld 큩硂⁹禳踆薱沕⦶ᰢ뻋熅ꌒӋ醯㘀䃂ዙ吐 ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::烘╗獓鿶ﬡI쓢ꭘ攬㻉ꋢ䭆㪵ﰯ慷䄛ᓇ callvirt System.Void 큩硂⁹禳踆薱沕⦶ᰢ뻋熅ꌒӋ醯㘀䃂ዙ吐::铠飷퓃馯䢨ꩂ瀃鐞丒ⲭ逈筷穅灒坓䨴驜롱꿉() call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::鱂Ｂ演뼊줨윎誘ꏝ弾맒롒嶿仪︒㊅顭ﶷȗ() call System.Void ꙻ猍捹？豲鏲쵦ᴬ홛焑�祤ϳꙞ貤吇⻌䍨๬쪄::噰潒ƛ孵噌⣣荺Ⓚ⯩䉖메쨲系혊쑉묾笐䍶놀() ret <null>

CnC CNCmalicious

193.1huhuhuhuhuhuhu

Port PORTmalicious

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential