I confirmed the presence of a tailcall to _CorExeMain() at the program’s entry point using Binary Ninja.
Therefore, I will use ILSpy to decompile the binary.
Approximately 60% of the obfuscated code has been successfully recovered. The command structure and operational behavior have now been clearly identified. Below is the confirmed command structure:
File
Command
Action
IMessage_ClientUninstall.cs
ClientUninstall
Uninstall QuasarRAT
IMessage_CloseConnection.cs
CloseConnection
Close C2 Server Connection
IMessage_GetSystemInfo.cs
GetSystemInfo
Get System Information
IMessage_Keylogger.cs
Keylogger
Log Keystrokes
IMessage_PasswordStealer.cs
PasswordStealer
Parse Passwords from Browsers
IMessage_Process.cs
Process
Add/Delete/Modify Processes
IMessage_Registry.cs
Registry
Add/Delete/Modify Registry
IMessage_ReverseProxy.cs
ReverseProxy
Spawn a Reverse Proxy
IMessage_ShellExecute.cs
ShellExecute
Execute a Shell Command
IMessage_ShowMessageBox.cs
ShowMessageBox
Show a Messagebox
IMessage_Shutdown.cs
Shutdown
Shutdown the Device
IMessage_StartupItem.cs
StartupItem
Add/Delete/Modify Startup Items
IMessage_VisitWebsite.cs
VisitWebsite
Open a Website Link
QuasarRAT communicates with its C2 server through an object called IMessage. This IMessage object encapsulates various payloads capable of performing tasks such as keylogging, command execution, and password theft.
Below is a list of the Windows API functions utilized by QuasarRAT during its operation:
File
API
DLL
API_Windows.cs
LoadLibrary
kernel32.dll
API_Windows.cs
FreeLibrary
kernel32.dll
API_Windows.cs
GetProcAddress
kernel32.dll
API_Windows.cs
QueryFullProcessImageName
kernel32.dll
API_Windows.cs
BitBlt
gdi32.dll
API_Windows.cs
CreateDC
gdi32.dll
API_Windows.cs
DeleteDC
gdi32.dll
API_Windows.cs
GetLastInputInfo
user32.dll
API_Windows.cs
SetCursorPos
user32.dll
API_Windows.cs
SendInput
user32.dll
API_Windows.cs
SystemParametersInfo
user32.dll
API_Windows.cs
PostMessage
user32.dll
API_Windows.cs
OpenDesktop
user32.dll
API_Windows.cs
CloseDesktop
user32.dll
API_Windows.cs
EnumDesktopWindows
user32.dll
API_Windows.cs
IsWindowVisible
user32.dll
API_Windows.cs
GetForegroundWindow
user32.dll
API_Windows.cs
GetWindowText
user32.dll
API_Windows.cs
GetExtendedTcpTable
iphlpapi.dll
API_Windows.cs
SetTcpEntry
iphlpapi.dll
API_Windows_FileAPIs.cs
DeleteFile
kernel32.dll
API_Unknown6.cs
UrlCanonicalize
shlwapi.dll
API_Unknown6.cs
FileTimeToSystemTime
kernel32.dll
API_Unknown6.cs
SystemTimeToFileTime
kernel32.dll
API_Unknown6.cs
CompareFileTime
kernel32.dll
API_Unknown6.cs
SHGetFileInfo
shell32.dll
Below is the list of password in applications that QuasarRAT is capable of parsing: