[GH-ISSUE #647] Why the generated program does not correspond to the size of "bin" #400

New issue

Closed

opened 2026-02-27 15:50:12 +03:00 by kerem · 3 comments

kerem commented

2026-02-27 15:50:12 +03:00

Owner

Originally created by @1zhanglingji on GitHub (Feb 27, 2018).
Original GitHub issue: https://github.com/quasar/Quasar/issues/647

emmmmm
I stumbled upon a problem

I try to locate the feature code, but the final program will be detected by the antivirus software

So I want the generation program to be generated completely according to bin

I don't understand English and I do not understand the use of C# QWQ

I come from China and hope you can reply to this question

(our country is harms by the back door so hope not to have a back door =3= thank you)

Originally created by @1zhanglingji on GitHub (Feb 27, 2018). Original GitHub issue: https://github.com/quasar/Quasar/issues/647 emmmmm I stumbled upon a problem I try to locate the feature code, but the final program will be detected by the antivirus software So I want the generation program to be generated completely according to bin I don't understand English and I do not understand the use of C# QWQ I come from China and hope you can reply to this question (our country is harms by the back door so hope not to have a back door =3= thank you)

kerem

2026-02-27 15:50:12 +03:00

closed this issue
added the
invalid
label

kerem commented

2026-02-27 15:50:13 +03:00

Author

Owner

@1zhanglingji commented on GitHub (Feb 27, 2018):

咳

@1zhanglingji commented on GitHub (Feb 27, 2018): 咳

kerem commented

2026-02-27 15:50:13 +03:00

Author

Owner

@ViCrack commented on GitHub (Apr 17, 2018):

其实我都看不太懂你说的是啥。
这种RAT工具本来就很容易被AntiVirus所杀，bin是用来辅助增加配置信息的，不可能生成之后完全一模一样，
还有这跟来自哪里没关系，就算不懂C#你也可以尝试抓包等来判断有无后门（何况人家都开源了）。

@ViCrack commented on GitHub (Apr 17, 2018): 其实我都看不太懂你说的是啥。这种RAT工具本来就很容易被AntiVirus所杀，bin是用来辅助增加配置信息的，不可能生成之后完全一模一样，还有这跟来自哪里没关系，就算不懂C#你也可以尝试抓包等来判断有无后门（何况人家都开源了）。

kerem commented

2026-02-27 15:50:13 +03:00

Author

Owner

@MaxXor commented on GitHub (Apr 17, 2018):

The names of numerous fields, methods and classes are being obfuscated when generating the client, thus the size doesn't match anymore with client.bin.
Check here phase 2 of the build process: https://github.com/quasar/QuasarRAT/blob/master/Server/Core/Build/ClientBuilder.cs#L122

Anyways, no discussion of making Quasar undetected by AV. Add an exception to your AV.

@MaxXor commented on GitHub (Apr 17, 2018): The names of numerous fields, methods and classes are being obfuscated when generating the client, thus the size doesn't match anymore with `client.bin`. Check here phase 2 of the build process: https://github.com/quasar/QuasarRAT/blob/master/Server/Core/Build/ClientBuilder.cs#L122 Anyways, no discussion of making Quasar undetected by AV. Add an exception to your AV.

kerem referenced this issue

2026-02-27 15:53:13 +03:00

[PR #400] [MERGED] PW Recovery user notification #1133