QuasarRAT Core Functionalities Along with Encrypted Configuration and Obfuscation Techniques Exposed
QuasarRAT, initially introduced as xRAT in 2014, was developed as a legitimate remote administration tool for Windows systems. Over time, its open-source nature has made it a versatile tool for malicious activities within the cybercriminal community.
QuasarRAT, initially introduced as xRAT in 2014, was developed as a legitimate remote administration tool for Windows systems. Over time, its open-source nature has made it a versatile tool for malicious activities within the cybercriminal community.
Built on the .NET Framework using C#, QuasarRAT offers adaptability for various malicious campaigns, enabling actions such as data theft and unauthorized network access. Its functionalities extend to system information extraction, file management, keystroke logging, and executing arbitrary commands. These capabilities facilitate persistent control over compromised systems, making it a choice tool for independent hackers and state-aligned entities.
Sekoia security analysts have noted the widespread use of QuasarRAT due to its ease of modification and source code availability on platforms like GitHub. This accessibility allows threat actors to tailor the malware to specific targets, enhancing its threat potential. QuasarRAT's ability to evade basic detection mechanisms through continuous code adaptation further underscores its persistent threat status. The malware integrates seamlessly into various attack chains, supporting both financial theft and intelligence gathering operations.
QuasarRAT, initially introduced as xRAT in 2014, was developed as a legitimate remote administration tool for Windows systems.
Unwrapping Encrypted Configuration and Obfuscation
Recent QuasarRAT samples exhibit advanced obfuscation techniques to conceal configuration data. While standard builds may leave settings unencrypted, malicious versions frequently employ robust obfuscation. These versions utilize AES-256 encryption in CBC mode to secure critical data, including Command-and-Control (C2) server information. The decryption key often uses PBKDF2 with a hardcoded salt value from the Aes256 class.
Analysts counter these defenses using Python combined with .NET libraries like dnlib to examine Intermediate Language (IL) code. The extraction process involves identifying the static constructor (.cctor) where the AES key is initialized. By analyzing IL instructions and locating opcodes such as ldstr and stsfld, researchers can retrieve cryptographic material, including the AES key and salt, without executing the malware.
In heavily obfuscated samples, the decryption routine is identified by analyzing method calls within the Settings class. Isolating the decryption function and salt enables the decryption of configuration strings, revealing the attacker's infrastructure and effectively countering attempts to obscure indicators of compromise.
Based on reporting by Cyber Security News.