QuasarRAT

QuasarRAT Description

The QuasarRAT is a Trojan that is a heavily modified version of the open-source project carrying the same name "QuasarRAT" by a programmer dubbed 'quasar' who has a page on Github.com/quasar/QuasarRAT. The QuasarRAT software is promoted as a Remote Administration Tool (RAT) for server admins and cyber security managers in the government and private sector. The clean and corrupt versions of QuasarRAT differ in how they are packed, the presence of an obfuscation layer and manner of network communication. The QuasarRAT or Quasar Remote Access Trojan was used in targeted attacks on the government of the United States of America in early 2017 and samples of the malware surfaced in October 2017 with new attacks being recorded. It is not clear who is behind the QuasarRAT threat, but its attack vector appears to remains the same.

  1. The Trojan Dropper is received by a targeted user as an attachment to a spear phishing email. The majority of the attachments associated with QuasarRAT appear to feature names like 'Scanned Document,' 'Audio Recording,' 'Presentation,' and other names, which can be perceived as titles for office documents. The fake documents may have a double extension and be masquerade as a safe file using icons associated with Microsoft Office. For example, what appears to be a text file may be titled 'Report HG485.docx.exe' and trigger a User Account Control prompt on the screen as opposed to loading in Microsoft Word.
  2. The Trojan-Dropper is observed to extract a copy of the Downeks threat, which we have seen in the past. The Downeks Trojan-Dropper connects to a hardcoded URL and downloads the main body of the QuasarRAT.
  3. The QuasarRAT is installed on the system, and the attacker can access all data saved on the computer and connected network data storage. Additionally, the attacker can use QuasarRAT to install third-party software, remove programs, terminate processes and take screenshots.

That is not the full range of operations the remote user can perform. Malware investigators add that the QuasarRAT operators could download files, edit the Registry, open remote desktop connections, collect passwords, load Web pages, issue commands to the keyboard and mouse. Cybersecurity experts discovered that the QuasarRAT threat exhibits vulnerabilities regarding the client-server communication. The vulnerabilities could be exploited and allow the infected PC user to launch a counterattack and install a copy of QuasarRAT on the 'Command and Control' servers used by the first attacker potentially. It is not a good idea to remove the QuasarRAT manually and attempt counterattacks if you are not a computer security expert with experience under your belt. Regular PC users are encouraged to use a reputable anti-malware solution to eliminate the QuasarRAT and block unauthorized connections to the system.

Technical Information

File System Details

QuasarRAT creates the following file(s):
# File Name Size MD5 Detection Count
1 c:\users\he\appdata\roaming\optigrillss\optigrillst.exe 190,464 59122b93dabdb8d0736adcf7f57f71df 30
2 c:\users\user\desktop\new folder\rat\a331499061e8a1dded334684862f917b7fd86ae46665427e83ed3701c2e6d47f.exe 146,913 5e9b44f43bc63b09d23370d80b2ebf42 7
3 file.exe 714,216 46d08a8be16768ee32fcbaa8083ea2f0 0
4 %APPDATA%\Microsoft Windows\winupdate64.exe 358,400 d0ba737dfa6e7d7bd83c9ea5740006d1 0
More files

Registry Details

QuasarRAT creates the following registry entry or registry entries:
Directory
%APPDATA%\optigrillss
%APPDATA%\SubDir
%APPDATA%\SubDirr
%WINDIR%\system32\SubDir
%WINDIR%\SysWOW64\SubDir
Regexp file mask
%APPDATA%\rocking.exe
%APPDATA%\K-Mart Corp\K-Mart Corp.exe
%APPDATA%\Microsoft\Windows\Update\Update.exe
%APPDATA%\system\core.exe
%WINDIR%\System32\Tasks\Quasar Client Startup
Registry key
SOFTWARE\Microsoft\Tracing\sschost_RASAPI32
SOFTWARE\Microsoft\Tracing\sschost_RASMANCS
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Quasar Client Startup
SOFTWARE\Wow6432Node\Microsoft\Tracing\sschost_RASAPI32
SOFTWARE\Wow6432Node\Microsoft\Tracing\sschost_RASMANCS

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.