Advent of Configuration Extraction

### Executive Summary This article describes a reproducible static-analysis workflow for extracting encrypted configuration from QuasarRAT (.NET RAT) binaries using pythonnet and dnlib within a containerised Jupyter environment. It covers locating the Config.Settings class and static constructor (.cctor), identifying cryptographic material (AES key, hardcoded salt, PBKDF2 derivation), enumerating and decrypting obfuscated strings, and automating extraction for both debug and obfuscated builds; code snippets and implementation details are provided to aid defenders and analysts.