Quasar RATMalware
- cinarat
- Yggdrasil
Quasar RAT is a malware family written in. NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.From MISP Galaxy
Last reported yesterday, by The Hacker News7 reports
ATT&CK techniques
6 of 34 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1543Create or Modify System Process
“Create or Modify System Process: Windows Service”
- T1543.003Windows Service
“T1543.003”
- T1005Data from Local System
“T1005”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1041Exfiltration Over C2 Channel
“T1041”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“…f a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“The attack involved the use of a novel backdoor that stored its command-and-control server inside Yggdrasil, an IPv6 mesh network.”
-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm”
-
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases“…Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as well as the overall attack chain shared numerous similarities with Kimsuky’s endpoint ransomware distribution cases observed since…”
-
Private HTS programs that spread ransomware“ASEC disclosed cases in 2023 and 2024 where an unauthorized HTS named “HPlus” distributed the Quasar RAT.”
-
Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite“…n used in state-sponsored espionage, non-state hacktivism, and criminal financially motivated attacks since 2017 (Qualys, Evolution of Quasar RAT), including by China-linked APT10.”
Indicators in its reports
named in the reports above- hxxps://uztickets[.]comin 2 reports
- uztickets[.]comin 2 reports
- hxxps://egyptanimals[.]com/animals/photoalbumin 2 reports
- egyptanimals[.]comin 2 reports
- adomd[.]netin 2 reports
- hxxp://51.15.204[.]214/in 2 reports
- 51.15.204[.]214in 2 reports
- d5f9288daebf87ae…cf235b093cfdin 2 reports
- b69ef0e45b401440…5d0c57e87415in 2 reports
- 4e3e6577866e4ce2…ae04230e768fin 2 reports
- 69969eeb7e0a3d84…cf934c6aa388in 2 reports
- 01855153ca7a33ad…12dfba0dd2cain 2 reports
- e29af83a07fb32eb…2e766d53f704in 2 reports
- 028ca11f3f0d8396…31fc2f50f829in 2 reports
- 9085896989947c09…f6b233fc645bin 2 reports
- d7e6a5a46c6ed351…1be0250fd2a2in 2 reports
- 131a371a1e4ee78e…9290ec3b58a6in 2 reports
- 09c816697c0c2aff…8ca30d04c9cdin 2 reports
- 8ceb5f8bcdf4995b…d682613bb17bin 2 reports
- 37.205.14[.]171in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.