Quasar RAT Technical Intelligence Dossier

Executive Summary & Threat Architecture

Quasar (broadly tracked as Quasar RAT, QuasarRAT, Backdoor:MSIL/Quasar, and Trojan.MSIL.Quasar) is a high-performance open-source remote access trojan (RAT) developed in C# (.NET) and publicly hosted on GitHub under an MIT license. Originally intended by its creator as a lightweight remote management and systems administration tool, Quasar was swiftly co-opted, modified, and weaponized by commercial cybercriminals and sophisticated nation-state advanced persistent threat (APT) groups. Notable state-sponsored threat actors utilizing custom variants of Quasar include APT10 (Stone Panda, MenuPass), APT33 (Elfin), the Syrian Electronic Army, and the Lazarus Group. Quasar operates over TCP/IP socket connections utilizing TLS-encrypted command-and-control streams, providing operators with a robust suite of remote management and surveillance features. Its capabilities include full reverse desktop remote control (Reverse RDP), SOCKS5 reverse proxy tunneling, real-time keystroke logging via SetWindowsHookEx, webcam and microphone capture, audio recording, interactive remote command shell execution (cmd.exe and PowerShell), process injection and termination, file upload and download, and registry manipulation. Cyber threat actors frequently deploy Quasar using weaponized phishing attachments delivering malicious Word documents exploiting equation editor vulnerabilities (CVE-2017-11882) or archived LNK shortcuts. Once executed, the initial stager utilizes process hollowing (T1055.012) to inject the compiled .NET assembly directly into legitimate Windows processes such as InstallUtil.exe, RegSvcs.exe, or MSBuild.exe to evade traditional signature-based antivirus solutions. In October 2018, CISA released Advisory AA18-337A warning organizations that nation-state cyber actors were routinely weaponizing open-source tools like Quasar RAT against critical infrastructure.

Observed Threat Aliases: QuasarRAT, Backdoor:MSIL/Quasar, Trojan.MSIL.Quasar, Win32/Quasar.RAT, Quasar Client, Quasar Remote Administration Tool

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: quasar_client_github

Documented Downstream Variants: quasar_v1.3, quasar_v1.4, cinedoor, apt10_quasar_fork

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Quasar RAT operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Spear-phishing emails containing malicious Office documents exploiting formula editor flaw CVE-2017-11882
• ISO or RAR archive attachments containing weaponized LNK shortcuts executing PowerShell
• Staged multi-stage loaders dropping obfuscated .NET assemblies into user profile directories

Host Persistence & Execution Hooks

• Scheduled task creation executing with highest privileges via schtasks /create /sc onlogon
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Quasar Client
• Process hollowing into trusted Windows utilities: InstallUtil.exe, RegSvcs.exe, or MSBuild.exe

Reference File Hashes (SHA-256)

• 5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102
• a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671
• 2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b