QuasarRat PE Executable malware analysis – fd4c9cb461c3

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Detection

PeID

Microsoft Visual C# / Basic .NET

Symbol obfuscation

Medium

1 malicious · 7 files

EXEfd4c9cb461c3b119ab15ed83344792d8QuasarRat

Structure

BINResources

BIN.Net Resources

Config. Field	Value
Conf. AES-Salt	BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key	bAamLVhuhuhuhuhuhuhu
Version	1.huhuhuhu
Port	1huhuhuhu
Host	161.huhuhuhu
ReconnectDelay	3huhuhuhu
Key	1WvgEMhuhuhuhuhuhuhu
AuthKey	NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory	michuhuhuhu
InstallName	Updathuhuhuhuhuhuhu
Install	0huhuhuhu
Startup	0huhuhuhu
Mutex	QSR_Mhuhuhuhuhuhuhu
StartupKey	servhuhuhuhuhuhuhu
HideFile	0huhuhuhu
EnableLogger	0huhuhuhu
Tag	rhuhuhuhu
LogDirectory	Lhuhuhuhu
HideLogDirectory	0huhuhuhu
HideLogSubdirectory	0huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::퉽ꗽ勗얣皗鼘천嘖厍觚츶ᰴⳕ오ಾ萖(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 筵ᥦ쮚짰讹痦鶝屇쩻㹳笪蜇糀嘕玑ﴠ൬綠::횊儷ﹱ䵖꘷㉬館钘홇ꆽ鮣褳鲟欻黱꼴ḗ깿요醋() brfalse.s IL_0040: call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() call System.Boolean 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::芢Ⴇ穄ښ杉喪蹤你ỢﭥⲼ폒ꛦ쳈慓䰼镏酉聏() brfalse.s IL_0040: call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() call System.Boolean ຓả暅㜁䏸쉠襁䨑ꃭ씣쬤빬괲ᷞ氽䶦“쪑::get_Exiting() brtrue.s IL_0040: call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() ldsfld ຓả暅㜁䏸쉠襁䨑ꃭ씣쬤빬괲ᷞ氽䶦“쪑 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::⡓랈ᝁ㟕꣈츌庭얙闹䶷焫愼啢ꁭ⛽裚ꇸ callvirt System.Void ຓả暅㜁䏸쉠襁䨑ꃭ씣쬤빬괲ᷞ氽䶦“쪑::✓䬃聮﯀ª鿹ꣷ呕춙뒳魯퓗貄䊯韊䐙꭪ᒋ砂() call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쏶š桌⦛좆犯黰쯺�ꞣ苉垟ウ䷘鹀ῒﾯ뉥() ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::Main(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.3.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	896
Main Method	System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::Main(System.String[])
Main IL Instruction Count	19
Main IL	call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::퉽ꗽ勗얣皗鼘천嘖厍觚츶ᰴⳕ오ಾ萖(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Boolean 筵ᥦ쮚짰讹痦鶝屇쩻㹳笪蜇糀嘕玑ﴠ൬綠::횊儷ﹱ䵖꘷㉬館钘홇ꆽ鮣褳鲟欻黱꼴ḗ깿요醋() brfalse.s IL_0040: call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() call System.Boolean 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::芢Ⴇ穄ښ杉喪蹤你ỢﭥⲼ폒ꛦ쳈慓䰼镏酉聏() brfalse.s IL_0040: call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() call System.Boolean ຓả暅㜁䏸쉠襁䨑ꃭ씣쬤빬괲ᷞ氽䶦“쪑::get_Exiting() brtrue.s IL_0040: call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() ldsfld ຓả暅㜁䏸쉠襁䨑ꃭ씣쬤빬괲ᷞ氽䶦“쪑 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::⡓랈ᝁ㟕꣈츌庭얙闹䶷焫愼啢ꁭ⛽裚ꇸ callvirt System.Void ຓả暅㜁䏸쉠襁䨑ꃭ씣쬤빬괲ᷞ氽䶦“쪑::✓䬃聮﯀ª鿹ꣷ呕춙뒳魯퓗貄䊯韊䐙꭪ᒋ砂() call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쓑钮¥〧뱖펋咓젩㖪뇷ァ絬籓⯧Ò腃() call System.Void 纘욭ꅚ籛穚䃩鮏㥳蔽츧被⚱ኳ䩶냢㍒::쏶š桌⦛좆犯黰쯺�ꞣ苉垟ウ䷘鹀ῒﾯ뉥() ret <null>

CnC CNCmalicious

161.huhuhuhu

Port PORTmalicious

1huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential