Quasar
Overview
Executive Summary
Quasar RAT is a powerful, open-source Remote Access Trojan (RAT) coded in C#. While originally developed and marketed as a legitimate remote administration tool, its robust feature set, high stability, and public availability on GitHub have made it a staple in the arsenals of cybercriminals and Advanced Persistent Threat (APT) groups. It is utilized post-compromise to maintain deep, interactive control over victim machines, facilitate lateral movement, and exfiltrate sensitive data.Infection Vector and Technical Capabilities
Quasar is typically deployed as a secondary payload. Threat actors distribute it via malicious email attachments (often weaponized Office documents), fake software installers, or drop it manually after successfully exploiting a vulnerable internet-facing service. Once active, it provides the attacker with total system control:- Extensive Surveillance Capabilities: The RAT includes built-in modules for real-time keylogging, remote desktop (RDP) viewing, webcam and microphone capture, and password recovery from major web browsers and FTP clients.
- File and System Management: Attackers have full file system access (upload, download, execute, delete), can interact with the command prompt and PowerShell, and can manipulate running processes and registry keys.
- Evasion and Persistence: Quasar client builds are highly customizable. Attackers routinely use crypters/packers to obfuscate the binary. It establishes persistence via Scheduled Tasks or Registry `Run` keys, and communicates with the Command and Control (C2) server using TLS-encrypted TCP connections, making network detection difficult.
Threat Assessment
A Quasar detection is a critical incident indicating a total compromise of the affected endpoint. The attacker has interactive, human-driven access to the machine and can steal any data present, deploy ransomware, or pivot to attack other internal servers.Incident Response and Remediation
- Immediate Network Isolation: Sever the machine's network connection instantly to terminate the attacker's interactive session and halt any ongoing data exfiltration.
- Hunt for Lateral Movement: Because Quasar is often used as a beachhead, incident responders must assume the attacker has attempted to move laterally. EDR and Active Directory logs must be scrutinized for compromised credentials and unauthorized access to other internal hosts.
- Total Re-imaging and Credential Rotation: The machine cannot be trusted and must be wiped to bare metal. All credentials (user, service accounts) that were exposed to or logged into the compromised machine must be immediately reset.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1071.001 T1056.001 T1055
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
- T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_QUASAR {
meta:
description = "Detects Quasar (trojan)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "quasar" ascii wide nocase
$s2 = "rat.quasar" ascii wide nocase
$s3 = "backdoor.msil.quasar" ascii wide nocase
$s4 = "win32/quasarrat" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Quasar Activity
id: e68a63fcb491fb3c2cf10eeb06d536e2
status: experimental
description: Detects generic indicators of the quasar malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*quasar*"
- "*rat.quasar*"
- "*backdoor.msil.quasar*"
- "*win32/quasarrat*"
condition: selection
level: mediumReferences & External Analysis
- MITRE ATT&CK: QuasarRAT (S0262)
- Search "quasar" on VirusTotal (External Analysis)
Frequently Asked Questions
Is QuasarRAT malware?
QuasarRAT is an open-source remote-administration tool (publicly on GitHub since at least 2014) that is frequently abused as a remote access trojan.
What language is QuasarRAT written in?
It is developed in C#.
What can QuasarRAT do when abused?
Provide remote control, keylogging, credential theft, and file access on a compromised system.
What is xRAT?
xRAT is an alias associated with the QuasarRAT project.
How does abused QuasarRAT reach victims?
Typically through phishing and malicious downloads, as with other RATs.
Why is an open-source tool a security concern?
Because the code is freely available, many actors can compile and customize their own builds, making variants common and varied.
Where is the authoritative reference?
MITRE ATT&CK's QuasarRAT entry (S0262), linked on this page.
How do I remove the Quasar Trojan from Windows?
Manual removal of Quasar is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Quasar a virus or a Trojan?
Quasar is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Quasar typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Quasar infection?
Symptoms of Quasar can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: trojan)
Explore other malware families in the same category:
Protect Your Network Against Trojans
Want to prevent Quasar and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/quasar.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.