Post

MAL-250610-01-01

QuasarRAT BlackBox Malware Analysis

Posted Updated
By The Rusty
4 min read
MAL-250610-01-01
MetadataInformation
Report IDMAL-250610-01-01
Incident DateUnknown
Report Date2025-06/10
Malware NameQuasarRAT
Version01
Analyst@therustymate
OrganizationPrivate
SeverityCritical
StatusPublic/Draft
Malware TypeRAT
Detection Date2025-06-10 00:20:15 UTC
Affected SystemsWindows/Home
CVEN/A
TagsBackdoor

Incident Metadata

MetadataInformation
Command & Control (C2) Server185.244.29[.]181:1604
Indicators of Compromise185.244.29[.]181:1604
Infection VectorDownload
Persistence MechanismsNYA
Payload DescriptionBackdoor
Network BehaviorC2 Connection & Communcation

File Names

File NameSize
edf5ee6173907a5c75650016186ea5a8.exe514’048 bytes

Hashes

File NameHash TypeHash
edf5ee6173907a5c75650016186ea5a8.exeMD5edf5ee6173907a5c75650016186ea5a8
 SHA18dabd536d13a57364812eb9c8d413c50b8788b8e
 SHA256cd425ba34aa2ac7f31b6c498b09780cd7bacb7d7826cdc119fd6a35e95ee8700
   

References

!!!WARNING!!! Some references may not be fully reliable.

TitleLink
MalwareBazaarhere

Blackbox Analysis

Anyrun URL: https://app.any.run/tasks/7fcb71c2-1a6c-4bfd-99e1-9aaaaa2490bd

0047e7ae    int32_t _CorExeMain()
0047e7ae  return _CorExeMain() __tailcall

I confirmed the presence of a tailcall to _CorExeMain() at the program’s entry point using Binary Ninja. Therefore, I will use ILSpy to decompile the binary.

csproj File Contents

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

<Project Sdk="Microsoft.NET.Sdk.WindowsDesktop">
  <PropertyGroup>
    <AssemblyName>Client</AssemblyName>
    <GenerateAssemblyInfo>False</GenerateAssemblyInfo>
    <OutputType>WinExe</OutputType>
    <UseWindowsForms>True</UseWindowsForms>
    <TargetFramework>net452</TargetFramework>
  </PropertyGroup>
  <PropertyGroup>
    <LangVersion>12.0</LangVersion>
    <AllowUnsafeBlocks>True</AllowUnsafeBlocks>
  </PropertyGroup>
  <PropertyGroup>
    <ApplicationManifest>app.manifest</ApplicationManifest>
    <RootNamespace />
  </PropertyGroup>
  <ItemGroup>
    <None Remove="ILRepack.List" />
    <EmbeddedResource Include="ILRepack.List" LogicalName="ILRepack.List" />
  </ItemGroup>
  <ItemGroup>
    <Reference Include="System.Core" />
    <Reference Include="System.Xml" />
    <Reference Include="System.Security" />
    <Reference Include="System.Runtime.Serialization" />
    <Reference Include="System.Web" />
    <Reference Include="System.Management" />
    <Reference Include="System.ServiceModel" />
  </ItemGroup>
</Project>
FieldValue
Project Type.NET SDK-style Windows Forms Desktop Application
Target Framework.NET Framework 4.5.2 (net452)
Output TypeWinExe (Graphical executable, no console window)
Assembly NameClient
Language VersionC# 12.0
Unsafe Code AllowedYes (AllowUnsafeBlocks=True)
Windows Forms EnabledYes (UseWindowsForms=True)
Auto Assembly Info GenerationDisabled (GenerateAssemblyInfo=False)
Manifest Fileapp.manifest
Embedded ResourceILRepack.List
Referenced LibrariesSystem.Core, System.Xml, System.Web, System.Management, System.ServiceModel, etc.

AssemblyInfo.cs File Contents

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Runtime.Versioning;
using System.Security;
using System.Security.Permissions;

[assembly: AssemblyDescription("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyProduct("Quasar")]
[assembly: AssemblyCopyright("Copyright © MaxXor 2020")]
[assembly: AssemblyTrademark("")]
[assembly: InternalsVisibleTo("Client.Tests")]
[assembly: ComVisible(false)]
[assembly: AssemblyFileVersion("1.4.0")]
[assembly: AssemblyTitle("Quasar Client")]
[assembly: AssemblyVersion("1.4.0.0")]
AttributeValue
TitleQuasar Client
ProductQuasar
Company(Empty)
Copyright© MaxXor 2020
File Version1.4.0
Assembly Version1.4.0.0
ComVisiblefalse (not visible to COM components)
InternalsVisibleToClient.Tests (likely for unit testing)

MaxXor is the original author of Quasar RAT.

ThisAssembly.cs File Contents

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

internal sealed class ThisAssembly
{
	internal const string AssemblyVersion = "2.4.0.0";

	internal const string AssemblyFileVersion = "2.4.6.0";

	internal const string AssemblyInformationalVersion = "2.4.6+g43df102394";

	internal const string AssemblyName = "protobuf-net";

	internal const string AssemblyTitle = "protobuf-net";

	internal const string AssemblyConfiguration = "Release";

	internal const string PublicKey = "002400000480000094000000060200000024000052534131000400000100010009ed9caa457bfc205716c3d4e8b255a63ddf71c9e53b1b5f574ab6ffdba11e80ab4b50be9c46d43b75206280070ddba67bd4c830f93f0317504a76ba6a48243c36d2590695991164592767a7bbc4453b34694e31e20815a096e4483605139a32a76ec2fef196507487329c12047bf6a68bca8ee9354155f4d01daf6eec5ff6bc";

	internal const string PublicKeyToken = "257b51d87d2e4d67";

	internal const string RootNamespace = "ProtoBuf";

	private ThisAssembly()
	{
	}
}
FieldValue
Assembly Version2.4.0.0
File Version2.4.6.0
Informational Version2.4.6+g43df102394
Assembly Nameprotobuf-net
Titleprotobuf-net
ConfigurationRelease
Public Key002400000480000094000000060200000024000052534131000400000100010009ed9caa457bfc205716c3d4e8b255a63ddf71c9e53b1b5f574ab6ffdba11e80ab4b50be9c46d43b75206280070ddba67bd4c830f93f0317504a76ba6a48243c36d2590695991164592767a7bbc4453b34694e31e20815a096e4483605139a32a76ec2fef196507487329c12047bf6a68bca8ee9354155f4d01daf6eec5ff6bc
Public Key Token257b51d87d2e4d67
Root NamespaceProtoBuf

Deobfuscation

Approximately 60% of the obfuscated code has been successfully recovered. The command structure and operational behavior have now been clearly identified. Below is the confirmed command structure:

FileCommandAction
IMessage_ClientUninstall.csClientUninstallUninstall QuasarRAT
IMessage_CloseConnection.csCloseConnectionClose C2 Server Connection
IMessage_GetSystemInfo.cs GetSystemInfoGet System Information
IMessage_Keylogger.cs KeyloggerLog Keystrokes
IMessage_PasswordStealer.csPasswordStealerParse Passwords from Browsers
IMessage_Process.cs ProcessAdd/Delete/Modify Processes
IMessage_Registry.cs RegistryAdd/Delete/Modify Registry
IMessage_ReverseProxy.cs ReverseProxySpawn a Reverse Proxy
IMessage_ShellExecute.cs ShellExecuteExecute a Shell Command
IMessage_ShowMessageBox.cs ShowMessageBoxShow a Messagebox
IMessage_Shutdown.cs ShutdownShutdown the Device
IMessage_StartupItem.cs StartupItemAdd/Delete/Modify Startup Items
IMessage_VisitWebsite.cs VisitWebsiteOpen a Website Link

QuasarRAT communicates with its C2 server through an object called IMessage. This IMessage object encapsulates various payloads capable of performing tasks such as keylogging, command execution, and password theft.

Below is a list of the Windows API functions utilized by QuasarRAT during its operation:

FileAPIDLL
API_Windows.csLoadLibrarykernel32.dll
API_Windows.csFreeLibrarykernel32.dll
API_Windows.csGetProcAddresskernel32.dll
API_Windows.csQueryFullProcessImageNamekernel32.dll
API_Windows.csBitBltgdi32.dll
API_Windows.csCreateDCgdi32.dll
API_Windows.csDeleteDCgdi32.dll
API_Windows.csGetLastInputInfouser32.dll
API_Windows.csSetCursorPosuser32.dll
API_Windows.csSendInputuser32.dll
API_Windows.csSystemParametersInfouser32.dll
API_Windows.csPostMessageuser32.dll
API_Windows.csOpenDesktopuser32.dll
API_Windows.csCloseDesktopuser32.dll
API_Windows.csEnumDesktopWindowsuser32.dll
API_Windows.csIsWindowVisibleuser32.dll
API_Windows.csGetForegroundWindowuser32.dll
API_Windows.csGetWindowTextuser32.dll
API_Windows.csGetExtendedTcpTableiphlpapi.dll
API_Windows.csSetTcpEntryiphlpapi.dll
   
API_Windows_FileAPIs.csDeleteFilekernel32.dll
   
API_Unknown6.csUrlCanonicalizeshlwapi.dll
API_Unknown6.csFileTimeToSystemTimekernel32.dll
API_Unknown6.csSystemTimeToFileTimekernel32.dll
API_Unknown6.csCompareFileTimekernel32.dll
API_Unknown6.csSHGetFileInfoshell32.dll
   

Below is the list of password in applications that QuasarRAT is capable of parsing:

Application NameFile
ChromeParser_ChromeLoginData.cs
OperaParser_OperaLoginData.cs
YandexParser_YandexLoginData.cs
FirefoxParser_FirefoxLoginData.cs
IE (Internet Explorer)Parser_IELoginData.cs
FileZillaParser_FileZillaLoginData.cs
WinSCPParser_WinSCPLoginData.cs
Malware Research, Malware Analysis
analysis csharp dotnet
This post is licensed under CC BY 4.0 by the author.