Exposing the Core Functionalities of QuasarRAT: Encrypted Configuration and Obfuscation Techniques

QuasarRAT Configuration Extraction Analysis

Security researchers have analyzed QuasarRAT, a .NET remote access trojan (RAT), detailing methods for extracting its encrypted configuration from both clean and obfuscated binary samples. This analysis was conducted using Jupyter Notebook, pythonnet, and dnSpy, providing cybersecurity professionals with practical tools to address this threat.

QuasarRAT, originally launched in 2014 as xRAT, is an open-source Windows remote administration tool. Although intended for legitimate use, it has been weaponized by cybercriminals and state actors. The malware supports various remote administration functions such as system reconnaissance, file manipulation, remote desktop viewing, keylogging, and command execution. These capabilities have been used in cyber espionage and unauthorized surveillance operations.

The configuration extraction methodology utilizes a combination of specialized tools:

dnlib : An open-source .NET library for inspecting and modifying .NET assemblies, enabling detailed malware analysis. pythonnet : Facilitates Python code invocation of dnlib’s APIs, integrating seamlessly with the analysis environment.

This setup allows researchers to decompile functions, traverse assembly structures, and extract custom types, metadata entries, and embedded strings. The process is containerized with Docker for portability and reproducibility across different environments.

QuasarRAT's configuration keys, including version, hosts, reconnect delay, installation parameters, encryption keys, and server certificates, are extracted from the Config namespace within the Settings class. The static constructor (.cctor method) initializes these fields.

The analysis targets the static constructor’s IL instructions, searching for paired operations where literal strings are loaded and referenced by class fields. This retrieves plaintext configuration values from clean samples.

The advanced strategy leverages QuasarRAT's runtime decryption mechanisms. The malware uses AES-256 in CBC mode, with key derivation via PBKDF2. The Aes256 class is identified through instantiations of System.Security.Cryptography.AesCryptoServiceProvider.

The salt value is recovered by resolving the metadata token loaded during the static constructor execution. The Settings Initialize method is identified as the sole caller of the decryption routine.

This approach to configuration extraction demonstrates the potential for automated analysis of .NET-based malware. While tailored to QuasarRAT, the modular workflow can adapt to other threats using similar patterns and cryptography APIs.

The QuasarRAT extractor code is available in the Sekoia.io Community Git repository, offering cybersecurity professionals tools for threat intelligence and incident response. This methodology, although not universal for all samples, provides accurate results for most real-world scenarios.

Based on reporting by GBHackers.