QuasarRat PE Executable malware analysis – 9ee1b15f5376

PE Executable

MD5: fc3a726da8293d06d748ae03945e597d

Size: 356.35 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Size

356.35 KB · 356,352 B

First seen

2025-11-23 00:49 · 11 months ago

Last seen

2025-11-23 00:49 · 11 months ago

Last analysis

2025-11-23 02:17 · 11 months ago

Hashes

MD5 fc3a726da8293d06d748ae03945e597d Sha1 8827449ef5efeeb1a2b26497396954d151e56de3 Sha256 9ee1b15f5376785c4d71d3f726fa45e5ce8310409fc506bea64d14426e185e28 Sha384 72ca94f30390976ab2e62fc9b1aa7dd6fb1e24433a97f9af2bc334c29c4d8e4395aa564ef9c15f5fa7999157387d9c32 Sha512 5a4e83d9ae4fa3ed1575cd18e3b3faa114fc95954564c4c5650b175a60bc069b6a0b467ba82b6db41b4eac9a4f660843677ab22784560d8cf5b70b03ac88cb2b SSDeep 6144:G46bPXhLApfpwc4FBGuVKbofr9Pn2jhOeRPPxn6:DmhApL4FBXxr9P2jMeRnxn6 TLSH 92749D6777A8E93BD1FD1736E432061547B0D407BA12F38B6A6C55B86E233868D813B3

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXEfc3a726da8293d06d748ae03945e597dQuasarRat

Structure

BINResources

BINRT_VERSION

BINID:0001

BINID:0

BINRT_MANIFEST

BINID:0001

BINID:0

BIN.Net Resources

BINxClient.Properties.Resources.resources

BINinformation

IMG[NBF]root.Data

IMG[NBF]root.Data-preview.png

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	aLOO2Jhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	azharhuhuhuhuhuhuhu
Host	azharhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	shuhuhuhu
InstallName	sethuhuhuhu
Install	0huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Sthuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	shuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎() brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪() brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting() brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣() call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::悦謬薠ꋏ�ཥ䄞υᜒ퉬쌵欄❫焗묫쟰鉅襨鉞(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 뼺坓໗Ꮍị㶲⣥罦挂떉莇鰜ౌ쯣㢛귩忨::俰Ὠ變䣥䦈㻄缃뵉்䕇⭋睬錻攓詚浗૜឵폲귎() brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() call System.Boolean ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ⅻⰡ셢틂㺱‡ꨜ㶱캿祪锩콷⡪遬딶鬶䙛◪() brfalse.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() call System.Boolean 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::get_Exiting() brtrue.s IL_0040: call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() ldsfld 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::틸뵁豮嬕仄ᙴ掆魊닆ᙪ넍ﳊ倽颏�࿂ᖂ낹ⓟパ callvirt System.Void 誃⏅程﫢齉혫奡伎Ⅲ稜ᨍ犫ꖕ✒浐廱ಓ::옹쌙ꏭ撝䔷ᖐ始腨昧⿴놰ﶊ಩꒜쿪픍摬虾칖룣() call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ᛣ嗍㊀ⓥ썲⦁�젪姞�ﷁ죜⨜뜜碼�쥏�() call System.Void ꥥ茙醰鬐黻虚秪᱙뫹ࡤ沱嫯′牬뎗핖絖셏ﮅ::ꔩ뛤퐱㗻풩㫽썓⌐믡⤧䜾弦襘䢙שׂꛆ狛麎锎() ret <null>

CnC CNCmalicious

azharhuhuhuhuhuhuhu

Port PORTmalicious

azharhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

1 malicious · 7 files

EXEfc3a726da8293d06d748ae03945e597dQuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	aLOO2Jhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	azharhuhuhuhuhuhuhu
Host	azharhuhuhuhuhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	shuhuhuhu
InstallName	sethuhuhuhu
Install	0huhuhuhu
Startup	1huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	Sthuhuhuhu
HideFile	0huhuhuhu
EnableLogger	1huhuhuhu
Tag	shuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

CnC CNCmalicious

azharhuhuhuhuhuhuhu

fc3a726da8293d06d748ae03945e597d

Port PORTmalicious

azharhuhuhuhuhuhuhu

fc3a726da8293d06d748ae03945e597d

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential