Netskope Threat Labs

QuasarRAT

ATP Sandbox Adv. Heuristics

Description

QuasarRAT is an open source remote access tool written in C# that has been publicly available on GitHub since at least 2014. Its free availability has made it a common implant choice in intrusions.

Stats

First seen
August 2022
Last seen
September 2026

Also known as

QuasarRatQuasarrat

MITRE ATT&CK techniques

25 techniques across 10 tactics.

TA0002 Execution

TA0003 Persistence

  • T1547Boot or Logon Autostart Execution

TA0004 Privilege Escalation

  • T1548Abuse Elevation Control Mechanism

TA0005 Stealth

TA0006 Credential Access

TA0007 Discovery

  • T1010Application Window Discovery
  • T1016System Network Configuration Discovery
  • T1033System Owner/User Discovery
  • T1082System Information Discovery
  • T1614System Location Discovery

TA0008 Lateral Movement

TA0009 Collection

TA0011 Command and Control

TA0112 Defense Impairment

Associated groups

Alert name variants

Alert Name
ByteCode-MSIL.Backdoor.Quasarrat
ByteCode-MSIL.Backdoor.QuasarRat
ByteCode-MSIL.Backdoor.QuasarRAT
ByteCode-MSIL.Downloader.QuasarRAT
ByteCode-MSIL.Trojan.QuasarRat
ByteCode-MSIL.Trojan.QuasarRAT
Document-Word.Trojan.Quasarrat
Script-BAT.Trojan.QuasarRAT
Script-Macro.Trojan.Quasarrat
Script-Macro.Trojan.QuasarRAT

Related families

InvisiMoleQakBotPlugXTrickBotWarzoneRAT

References