{
  "family": "quasarrat",
  "sample_count": 280,
  "category": "rat",
  "description": "QuasarRAT (frequently tracked as Quasar, Quasar Remote Administration Tool, and Backdoor:MSIL/Quasar) is a powerful open-source remote access trojan coded in C# (.NET). While originally published on GitHub by developer 'MaxXor' as an administrative management utility, the software's lightweight architecture, robust TLS encryption, and modular design led to widespread weaponization across cybercrime groups and advanced persistent threat (APT) actors. The implant establishes reverse TCP connections to command-and-control infrastructure using TLS-secured sockets with optional certificate pinning to defeat SSL/TLS inspection proxies. Once connected, Quasar delivers an exhaustive suite of surveillance capabilities: real-time desktop screen streaming, audio capturing, keystroke logging, reverse socks5 proxy routing, file system traversal, remote shell access, and process management. It systematically extracts stored credentials from web browsers (Chrome, Edge, Firefox), FTP clients, and email clients. Multiple government advisories (including CISA Alert AA18-337A) highlight Quasar's deployment by nation-state actors including APT10 and APT33 for long-term target surveillance.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Quasar RAT",
    "Quasar",
    "Backdoor.MSIL.Quasar",
    "Win32/Quasar"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is QuasarRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "QuasarRAT is an open-source .NET remote access trojan that provides threat actors with encrypted remote administration, desktop monitoring, keylogging, and credential theft capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "Who uses Quasar RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quasar is used by a broad spectrum of threat actors, from low-tier cybercriminals conducting credential theft to advanced nation-state groups like APT10 and APT33 executing targeted corporate espionage."
      }
    },
    {
      "@type": "Question",
      "name": "How does Quasar encrypt its network traffic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quasar encrypts C2 communications using AES-128 or AES-256 over custom TLS connections, frequently embedding self-signed certificates into clients to authenticate the server."
      }
    },
    {
      "@type": "Question",
      "name": "What data does Quasar RAT steal from infected computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quasar extracts stored passwords from web browsers, email clients, FTP utilities, Windows credentials vaults, real-time keystroke logs, and webcam/audio feeds."
      }
    },
    {
      "@type": "Question",
      "name": "How do defenders detect Quasar RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders detect Quasar by inspecting suspicious .NET assemblies executing from user directories, monitoring outbound TLS traffic on non-standard ports, and checking autostart registry entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1573.002",
    "T1021.001",
    "T1547.001",
    "T1082",
    "T1113",
    "T1041"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "credential-access"
    },
    {
      "id": "T1573.002",
      "name": "Asymmetric Cryptography",
      "tactic": "command-and-control"
    },
    {
      "id": "T1021.001",
      "name": "Remote Desktop Protocol",
      "tactic": "lateral-movement"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "discovery"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "exfiltration"
    }
  ],
  "cisa_advisory": "AA18-337A",
  "last_updated": "2026-10-16",
  "first_seen": 2014,
  "lineage": {
    "derived_from": [
      "quasar open-source repository"
    ],
    "variants": [
      "quasar rat v1.3",
      "quasar rat v1.4",
      "custom apt-modified quasar"
    ]
  },
  "attribution": [
    {
      "actor": "APT10, APT33, Gaza Cybergang, Diverse Cybercrime Actors",
      "confidence": "high"
    }
  ],
  "exploited_cves": [],
  "c2_profile": {
    "protocols": [
      "TLS",
      "TCP"
    ],
    "ports": [
      443,
      4782,
      8888
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "a4c7e6b0142b6a7a58a7be8e7e1273934d70b6d19a2e31d4512b18972b9a1111",
      "f7b2c93847849e7552eb412854c6020c644d622830f0f35a4d467888b13d2222"
    ],
    "delivery": [
      "spear_phishing_attachments",
      "malicious_office_macros",
      "software_cracks"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Scheduled Task Creation"
    ]
  },
  "sources": [
    {
      "name": "CISA Advisory AA18-337A: Overview of Quasar RAT",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa18-337a"
    },
    {
      "name": "MITRE ATT&CK Software Profile: Quasar (S0262)",
      "url": "https://attack.mitre.org/software/S0262/"
    },
    {
      "name": "GitHub: Quasar Development Repository",
      "url": "https://github.com/quasar/Quasar"
    }
  ],
  "containment_steps": [
    "Terminate suspicious .NET processes executing out of user temporary or AppData directories.",
    "Inspect and remove unauthorized autostart registry entries under CurrentVersion\\Run.",
    "Sever active outbound TCP connections to unknown IP addresses on ports 4782 or 443.",
    "Force domain password resets for all users whose workstations show evidence of Quasar execution."
  ],
  "what_to_avoid": [
    "Do not treat Quasar as a legitimate administrative tool in enterprise environments; its presence indicates unauthorized access.",
    "Avoid relying solely on default port monitoring; Quasar's C2 port is freely configurable by the operator.",
    "Do not overlook infected developer machines where .NET tools might otherwise escape suspicion."
  ],
  "target_industries": [
    "defense",
    "government",
    "technology",
    "aerospace",
    "financial_services"
  ],
  "motivation": "Unauthorized Remote Control, Cyber Espionage & Credential Harvesting",
  "threat_actors": [
    "APT10",
    "APT33",
    "Gaza Cybergang"
  ],
  "target_geographies": [
    "GLOBAL",
    "US",
    "EU",
    "APAC",
    "ME"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "defense-evasion",
    "credential-access",
    "discovery",
    "collection",
    "command-and-control"
  ],
  "ecosystem": [
    "windows"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}