#Quasar rat update#
#Quasar rat full#
#Quasar rat code#
#Quasar rat password#
#Quasar rat windows#

When analysing a piece of code – especially a decryption algorithm – it’s important to understand the journey the encrypted string takes. net framework functionality and quick scripting potential. Each has benefits and drawbacks, but we ultimately decided to use PowerShell for its access to the. We had three choices: use Python, C# or PowerShell. The main decision here was how we were going to get the decrypted strings without running the malware – this was a static analysis task.

The decryption algorithm is different to the source code of Quasar RAT therefore, some custom decryption is required. We click on the decrypt function and the main decryption algorithm shows there are several processes that the code runs before returning the decrypted string and updating the Settings.cs file. This function Base64 decodes the string before passing the decoded result into the main decryption function. Now if we return to the Settings.cs file, you will see that the TAG is the first string to go through the decryption algorithm.

#Quasar rat password#

We click on the SetDefaultKey function, which is called with the encryption key as a parameter the function seems to be deriving an auth key of 64 bytes and a default key of 16 bytes (looks like a key for AES) from the rfc2898derivebytes function, which is a PBKDF2 implementation that basically hashes a password and salt a specified number of times. It looks to be following a similar process to decrypt the strings within this file however, the way the encryption key is created looks slightly different to how it was created in the original source code. We proceed to sClient.Config/Settings to find what looks like various Base64-encoded strings and an initialise function.

#Quasar rat windows#

net decompiler that will bring the Windows executable back to its original source code. For example, looking inside the cryptography directory within the RAT, you will find standard encryption – nothing fancy or difficult to reverse.Īs we know the RAT is coded in C#, we can open the sample inside ILSpy, a.

#Quasar rat update#

The attacker simply needs to update the fields within this file, compile, and then send the malware out.Īs you can see, the C# coded RAT initialises each field within this file by calling a function within the class AES – aes.Decrypt.Īnalysis of the source code was helpful as it provided us with valuable information and helped us understand where we should direct our efforts – something that isn’t always clear when analysing malware. Normally this is done as a resource file within a Windows executable, but within Quasar we can see it is in Quasar.Client/Config/Settings.cs. Advanced threat actors will likely change the encryption algorithm to better suit their security practices.Īttackers who have purchased a sample will only need to update a few lines of code before deploying their malware in the wild (this being their C2 domain, encryption key and other such information that will be discussed later). However, this means that each sample purchased in this manner is likely to be encrypted in the same way (especially if used by a script kiddie). RAT as a service has become big business for attackers, as they can create remote access tools and sell them as samples to interested parties. AnalysisĪfter sourcing a malware sample, our first port of call was identifying the Quasar Rat’s source code, which can be found here: QuasarRAT. The goal then becomes identifying as many indicators of compromise as possible. This is usually so they can block this domain from their network and at least begin fighting the malware. When analysing a suspected RAT, the first thing an incident response team wish to know is the command and control centre’s domain. In this article, we will will take you through the process of analysing a Quasar RAT sample and discuss our decisions.

#Quasar rat full#

Quasar RAT is an open-source RAT coded in C# that has been utilised by everyone from script kiddies to full APT groups. The NCSC has stated that within the UK, APT10 has principally used the remote access trojan (RAT) Quasar RAT to steal data. APT10, a known threat actor since 2009, targets defence, healthcare, aerospace, mining and other industries.

On 20th December 2018, the NCSC released an updated report on the threat actor APT10 (following their 29th August 2018 report).