By GoldSparrow in Trojans

Threat Scorecard

Ranking: 2,857
Threat Level: 80 % (High)
Infected Computers: 24,583
First Seen: August 30, 2016
Last Seen: September 20, 2023
OS(es) Affected: Windows

The QuasarRAT is a Trojan that is a heavily modified version of the open-source project carrying the same name "QuasarRAT" by a programmer dubbed 'quasar' who has a page on Github.com/quasar/QuasarRAT. The QuasarRAT software is promoted as a Remote Administration Tool (RAT) for server admins and cyber security managers in the government and private sector. The clean and corrupt versions of QuasarRAT differ in how they are packed, the presence of an obfuscation layer and manner of network communication. The QuasarRAT or Quasar Remote Access Trojan was used in targeted attacks on the government of the United States of America in early 2017 and samples of the malware surfaced in October 2017 with new attacks being recorded. It is not clear who is behind the QuasarRAT threat, but its attack vector appears to remains the same.

  1. The Trojan Dropper is received by a targeted user as an attachment to a spear phishing email. The majority of the attachments associated with QuasarRAT appear to feature names like 'Scanned Document,' 'Audio Recording,' 'Presentation,' and other names, which can be perceived as titles for office documents. The fake documents may have a double extension and be masquerade as a safe file using icons associated with Microsoft Office. For example, what appears to be a text file may be titled 'Report HG485.docx.exe' and trigger a User Account Control prompt on the screen as opposed to loading in Microsoft Word.
  2. The Trojan-Dropper is observed to extract a copy of the Downeks threat, which we have seen in the past. The Downeks Trojan-Dropper connects to a hardcoded URL and downloads the main body of the QuasarRAT.
  3. The QuasarRAT is installed on the system, and the attacker can access all data saved on the computer and connected network data storage. Additionally, the attacker can use QuasarRAT to install third-party software, remove programs, terminate processes and take screenshots.

That is not the full range of operations the remote user can perform. Malware investigators add that the QuasarRAT operators could download files, edit the Registry, open remote desktop connections, collect passwords, load Web pages, issue commands to the keyboard and mouse. Cybersecurity experts discovered that the QuasarRAT threat exhibits vulnerabilities regarding the client-server communication. The vulnerabilities could be exploited and allow the infected PC user to launch a counterattack and install a copy of QuasarRAT on the 'Command and Control' servers used by the first attacker potentially. It is not a good idea to remove the QuasarRAT manually and attempt counterattacks if you are not a computer security expert with experience under your belt. Regular PC users are encouraged to use a reputable anti-malware solution to eliminate the QuasarRAT and block unauthorized connections to the system.

SpyHunter Detects & Remove QuasarRAT

File System Details

QuasarRAT may create the following file(s):
# File Name MD5 Detections
1. optigrillst.exe 59122b93dabdb8d0736adcf7f57f71df 30
2. file.exe 46d08a8be16768ee32fcbaa8083ea2f0 0

Registry Details

QuasarRAT may create the following registry entry or registry entries:
Regexp file mask
%APPDATA%\K-Mart Corp\K-Mart Corp.exe
%WINDIR%\System32\Tasks\Quasar Client Startup
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Quasar Client Startup


QuasarRAT may create the following directory or directories:



Most Viewed