Quasar Remote Administration Tool: Forensic Reverse-Engineering & Architectural Dossier

QuasarRAT is an open-source remote access trojan authored in C# (.NET Framework), widely weaponized across commodity cybercrime and advanced persistent threat operations. The implant establishes persistent, full-duplex TCP socket connections over TLS with pinned X.509 certificate validation. Its builder GUI allows operators to generate custom client executables equipped with startup persistence (Registry Run keys, Scheduled Tasks), process self-defense via RtlSetProcessIsCritical, low-level global keystroke logging (WH_KEYBOARD_LL), reverse SOCKS5 proxying, and interactive GDI+ desktop streaming.

Detailed reverse-engineering specifications archived in laboratory telemetry.

{
  "structureType": "Deserialized Static Class Model (Settings.cs)",
  "decryptionRoutine": "Settings class fields are stored as Base64 strings encrypted with AES-128-CBC. At runtime, the client decrypts each string using a key derived from the embedded password string via PBKDF2 (Rfc2898DeriveBytes) and an embedded static salt.",
  "inMemoryLayout": "public static class Settings {\n    public static string Version = \"1.4.1\";\n    public static string Hosts = \"192.168.1.100:4782;\";\n    public static string Password = \"EnCrYpTeD_PaSsWoRd\";\n    public static string InstallPath = @\"%APPDATA%\\SubDir\\client.exe\";\n    public static string Mutex = \"d0a927a4-8461-460b-80df-5418b76c02ef\";\n    public static string EncryptionKey = \"AESKeyBase64==\";\n    public static string AuthKey = \"HMACKeyBase64==\";\n    public static bool Install = true;\n    public static bool Startup = true;\n    public static bool HideFile = true;\n    public static bool Keylogger = true;\n}",
  "panelConfigOptions": "Quasar Builder GUI tabs: (1) Connection: Hostname/IP, Port (default 4782), Reconnect Delay; (2) Installation: Install Subdirectory (AppData, Local, ProgramFiles), Executable Name, Hide File; (3) Surveillance: Keylogger toggle, Webcam toggle; (4) Monitoring: Startup Run Key, Scheduled Task toggle, Mutex string, Set Process Critical (BSOD on kill); (5) Assembly: Icon changer, Assembly Metadata cloner; (6) Cryptography: TLS Certificate generator (.p12), Certificate Pinning SHA-256 fingerprint."
}

{
  "mutualExclusion": "Instantiates a system Mutex (new Mutex(false, Settings.Mutex)) at process start. If the mutex already exists, the process calls Environment.Exit(0) immediately.",
  "processProtection": "Optionally invokes native NTAPI via P/Invoke ntdll.dll!RtlSetProcessIsCritical(1, NULL, 0). Marking the client process as critical forces the Windows kernel to trigger a BugCheck (BSOD 0xEF CRITICAL_PROCESS_DIED) if the process is terminated by Task Manager or security tools.",
  "persistenceMechanics": "Writes binary path to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run or generates an elevated Scheduled Task via hidden process execution of schtasks.exe /create /tn \"<TaskName>\" /tr \"<Path>\" /sc onlogon /rl highest.",
  "surveillanceHooks": "Installs a low-level global keyboard hook (SetWindowsHookEx(WH_KEYBOARD_LL, ...)) to capture keystrokes, active window titles (GetForegroundWindow, GetWindowText), and clipboard contents (Clipboard.GetText), writing to an encrypted local buffer before transmission."
}

Concrete technical breakdown of functional modules implemented in the Quasar Remote Administration Tool binary:

QuasarRAT utilizes raw TCP sockets encrypted with TLS via the .NET SslStream class. The client validates the server's certificate against a pinned SHA-256 public key hash configured during compilation. Message framing follows a 5-byte header convention: [ 4-byte Int32 Payload Length (Little-Endian) ] [ 1-byte Message Type Identifier ] [ Serialized Binary Payload ]. In standard Quasar builds, payloads are serialized using custom binary writers or Protocol Buffers/MsgPack in modified variants. Payload contents are symmetrically encrypted with AES-128-CBC using a key derived from the configuration password via PBKDF2.

Indicators of compromise and forensic patterns recorded across laboratory triage:

// Decompiled QuasarRAT Client Settings Decryption & TLS Connection
public static void DecryptSettings() {
    byte[] authKey = Convert.FromBase64String(Settings.AuthKey);
    byte[] encKey = Convert.FromBase64String(Settings.EncryptionKey);
    Rfc2898DeriveBytes derive = new Rfc2898DeriveBytes(Settings.Password, authKey, 50000);
    byte[] aesKey = derive.GetBytes(16);
    byte[] aesIv = derive.GetBytes(16);
    Settings.Hosts = AES.Decrypt(Settings.Hosts, aesKey, aesIv);
    Settings.Mutex = AES.Decrypt(Settings.Mutex, aesKey, aesIv);
}

public static bool ValidateServerCertificate(object sender, X509Certificate cert, X509Chain chain, SslPolicyErrors errors) {
    // Validate against pinned SHA-256 certificate fingerprint
    return cert.GetCertHashString() == Settings.CertificateHash;
}