QuasarRATTool
QuasarRAT is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. QuasarRAT is developed in the C# language.From MITRE ATT&CK
Last reported 2 days ago, by Group-IB4 reports
ATT&CK techniques
6 of 66 · each with the sentence it comes from- T1056.001Keylogging
“T1056.001”
- T1001Data Obfuscation
“T1001”
- T1005Data from Local System
“T1005”
- T1007System Service Discovery
“T1007”
- T1010Application Window Discovery
“T1010”
- T1012Query Registry
“T1012”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Inside SiriusQT: A Seriously Skilled RAT“SiriusQT has been observed in relation to other malware families, such as Remcos, XWorm, AsyncRAT and QuasarRAT/NJRAT, since SiriusQT operators may rely on shared or reused infrastructure.”
-
From APT28 to RePythonNET: automating .NET malware analysis“The second article detailed how we leverage pythonnet to extract the configuration of QuasarRAT, an open-source .NET-based RAT publicly available on GitHub.”
-
Advent of Configuration Extraction, Part 2: QuasarRAT Config“Advent of Configuration Extraction, Part 2: QuasarRAT Config”
-
Advent of Configuration Extraction, Part 1: Kaiji Configuration“In Part 2, we will continue this exploration by examining configuration extraction for .NET‑based malware, using the case of QuasarRAT as a more advanced and structured example.”
Indicators in its reports
named in the reports above- instr.opcode[.]namein 2 reports
- instr.operand[.]namein 2 reports
- hxxps://github[.]com/SEKOIA-IO/RePythonNET-MCPin 1 report
- x.opcode[.]namein 1 report
- 69609e89b04d8d27…cf3303be8906in 1 report
- vb[.]netin 1 report
- main.test[.]namein 1 report
- field[.]namein 1 report
- 4ef44bf6815e7860…912c38ac9639in 1 report
- mtype[.]namein 1 report
- instr.operand.declaringtype[.]namein 1 report
- typedef[.]namein 1 report
- method[.]namein 1 report
- 695909032488e343…8228e0f289e4in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.