QuasarRAT

QuasarRAT is an open-source remote access tool for Windows developed using C# and available on GitHub. QuasarRAT provides an easy-to-use user interface and a high stability that makes it an attractive tool for a variety of threat actors. It is a common practice among threat actors to make use of publicly available tools in their attacks in order to difficult the attribution efforts. According to the mapping provided by the ATT&CK™ team (https://attack.mitre.org/software/S0262/), QuasarRAT is capable of the techniques and sub-techniques shown as following:

Figure 8.31 - QuasarRAT capabilities according MITRE ATT&CK™

Before moving into executing and hunting QuasarRAT, let’s learn a bit about some of the real world cases and threat actors that had leveraged QuasarRAT for malicious purposes.

QuasarRAT real world use cases

One of the most common problems when studying the advanced persistent threats activity is in the different naming conventions...