Loading malware…
QuasarRAT, also known as Quasar, is an open-source remote administration tool written in C# for Windows that is widely abused as a remote access trojan by cybercriminals and espionage actors. Its capabilities include remote command execution, interactive desktop access, file transfer, keylogging, screen capture, and recovery of passwords stored by common FTP clients. It supports TCP-based command-and-control communications and enables operators to maintain interactive access and deploy additional malware.
Distribution includes deceptive software repositories, malicious packages, counterfeit AI applications, and malicious documents. QuasarRAT has also been deployed after exploitation of internet-facing applications, including Windows PHP CGI installations vulnerable to CVE-2024-4577 and DameWare Mini Remote Control installations vulnerable to CVE-2019-3980. Deployment chains have used batch scripts, PowerShell, encrypted payloads, and in-memory loading. Modified strings and Themida-packed variants have been observed as evasion measures, while scheduled tasks have been used in attempts to maintain persistence.
Documented users include APT10, APT33, Patchwork, Gorgon Group, Kimsuky, UAT-10147, and a financially motivated Lazarus subgroup. In Kimsuky-linked campaigns, résumé-themed Hangul documents initiated multistage script execution that installed QuasarRAT, which operators subsequently used to execute Funhouse ransomware. Its use spans compromised Windows endpoints and servers, including industrial-sector systems. Its public availability and adoption by unrelated operators make its presence alone insufficient for threat-actor attribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
17 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Для проникновения в инфраструктуру атакующие воспользовались RCE-уязвимостью CVE-2019-3980.
Bitdefender issued a critical security advisory regarding CVE-2024-4577, a severe argument injection vulnerability in PHP affecting Windows-based systems running in CGI mode. Since our initial advisory, exploitation attempts have been steadily rising. | In this campaign, Quasar was deployed using batch scripts that download the RAT from known command-and-control (C2) servers.
CVE-2023-46604는 오픈 소스 메시징 및 통합 패턴 서버인 Apache ActiveMQ 서버의 원격 코드 실행 취약점이다. 만약 패치되지 않은 Apache ActiveMQ 서버가 외부에 노출되어 있을 경우 공격자는 원격에서 악의적인 명령을 실행하여 해당 시스템을 장악할 수 있다.
Some of the vulnerabilities weaponized by the threat actor over the course of the campaign include CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2019-18935 (Telerik UI for ASP.NET AJAX), CVE-2021-29441, and CVE-2021-29442 (Alibaba Nacos).
Some of the vulnerabilities weaponized by the threat actor over the course of the campaign include CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2019-18935 (Telerik UI for ASP.NET AJAX), CVE-2021-29441, and CVE-2021-29442 (Alibaba Nacos).
Some of the vulnerabilities weaponized by the threat actor over the course of the campaign include CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2019-18935 (Telerik UI for ASP.NET AJAX), CVE-2021-29441, and CVE-2021-29442 (Alibaba Nacos).
Some of the vulnerabilities weaponized by the threat actor over the course of the campaign include CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2019-18935 (Telerik UI for ASP.NET AJAX), CVE-2021-29441, and CVE-2021-29442 (Alibaba Nacos).
Some of the vulnerabilities weaponized by the threat actor over the course of the campaign include CVE-2022-27925 (Zimbra), CVE-2021-23758 (AjaxPro), CVE-2019-18935 (Telerik UI for ASP.NET AJAX), CVE-2021-29441, and CVE-2021-29442 (Alibaba Nacos).
In this blog post, I’ll be diving into the technical details of the WinRAR vulnerability, identified as CVE-2025-8088. This vulnerability carries a high severity score of 8.4 and affects WinRAR on Windows operating systems due to a path traversal flaw. | Quasar RAT The RAR archive contains text files and an Alternate Data Stream (ADS) linked to a Quasar RAT executable.
Researchers observed attackers leveraging Zerologon, or CVE-2020-1472, a Microsoft zero-day elevation-of-privilege vulnerability first disclosed and patched on Aug. 11. The flaw—which stems from the Netlogon Remote Protocol available on Windows domain controllers–allows attackers to spoof a domain controller account and then use it to steal domain credentials, take over the domain and completely compromise all Active Directory identity services. | Attackers also installed the QuasarRAT open-source backdoor and novel Backdoor.Hartip tool to continue surveillance on victims’ systems.
These attacks use dcRAT and QuasarRAT for Windows delivered via malicious documents exploiting CVE-2017-11882 — a memory corruption vulnerability in Microsoft Office... A typical infection would consist of a malicious document, such as an RTF file exploiting CVE-2017-11882, a stack overflow vulnerability that enables arbitrary code execution on a vulnerable version of Microsoft Office. | The attack phase consists of deploying RAT payloads, such as DcRAT and QuasarRAT, to the victim’s endpoint.
Both RTFs exploited CVE-2012-0158 and acted as downloaders to ultimately deliver the QuasarRAT malware family.
Among these tricks are using right-to-left override to obscure the attachments’ real extension, email attachments disguised as RAR self-extracting archives, and a combination of a specially crafted Word document carrying a CVE-2017-0199 exploit. | We have detected three different strains of .NET malware in these campaigns: Quasar RAT, Sobaken RAT, and a custom-made RAT called Vermin.
Exploit public facing app: LookingFrog and JollyFrog CVE-2019-0604 ProxyLogon (March 2021) ProxyShell (August 2021)
Exploit public facing app: LookingFrog and JollyFrog CVE-2019-0604 ProxyLogon (March 2021) ProxyShell (August 2021)
Exploit public facing app: LookingFrog and JollyFrog CVE-2019-0604 ProxyLogon (March 2021) ProxyShell (August 2021)
Threat Details and IOCs Malware: ... Quasar RAT, QuasarRAT ...
31 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“It was built as a legitimate admin tool, but its public code has made it a regular in criminal and espionage campaigns.”
“It was built as a legitimate admin tool, but its public code has made it a regular in criminal and espionage campaigns.”
On Windows systems, UAT-10147 ... deploys malware including BadIIS, QuasarRAT, Gh0stCringe and SPECTRE.
Quasar RAT serves as the tool used to deploy the ransomware.
Patchwork has obtained and used open-source tools such as QuasarRAT.
Patchwork has obtained and used open-source tools such as QuasarRAT.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers are buying expired domains to exploit their reputation, traffic and DNS history, using them for malware delivery, scams and C2 infrastructure.
The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale.
Using the secondary batch script to silently execute Quasar RAT and establish persistence using a deceptive scheduled task named "Google Chrome Start"
In one case, the threat actor is said to have successfully exploited a website and collected information about the victim host using Linux commands.
File name back.bat Alternate name for the main Windows deployment script File name bai.bat Secondary batch script used for backdoor execution and persistence File name user.bat Script used to create a privileged local account
This vulnerability carries a high severity score of 8.4 and affects WinRAR on Windows operating systems due to a path traversal flaw.
establish persistence using a deceptive scheduled task named "Google Chrome Start"
часть инфраструктуры Sable Squirrel используется для работы малвари: к доменам хак-группы обращались более 31 000 образцов вредоносов... некоторые сайты одновременно показывали посетителям спортивные трансляции и работали в качестве управляющих серверов для малвари.
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
1,279 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source C# remote administration tool explicitly described as abused for criminal activity and espionage. Capabilities include remote desktop, file management, password recovery, and a reverse shell. The article identifies phishing and DLL sideloading as delivery methods and lists default port 4782 and the Quasar Server CA certificate as hunting artifacts.
A remote access trojan delivered in an executable named grok.exe to impersonate an AI product. The report does not provide additional family-specific behavior or infrastructure details.
Remote access trojan identified in an executable named grok.exe, using AI-product branding as a lure. No additional payload behavior or campaign attribution is provided.
Remote access tooling installed after the script and Python-backdoor stages and used to deploy Funhouse ransomware. Its configuration is stored in a .dwg file containing a command-and-control address, target identifier, and mutex. The unchanged mutex across the February, June, and September cases supports continuity between the Endpoint and Funhouse campaigns despite changed infrastructure and configuration versions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.