QuasarRAT

The QuasarRAT is a Trojan that is a heavily modified version of the open-source project carrying the same name "QuasarRAT" by a programmer dubbed 'quasar' who has a page on Github.com/quasar/QuasarRAT. The QuasarRAT software is promoted as a Remote Administration Tool (RAT) for server admins and cyber security managers in the government and private sector. The clean and corrupt versions of QuasarRAT differ in how they are packed, the presence of an obfuscation layer and manner of network communication. The QuasarRAT or Quasar Remote Access Trojan was used in targeted attacks on the government of the United States of America in early 2017 and samples of the malware surfaced in October 2017 with new attacks being recorded. It is not clear who is behind the QuasarRAT threat, but its attack vector appears to remains the same.

1. The Trojan Dropper is received by a targeted user as an attachment to a spear phishing email. The majority of the attachments associated with QuasarRAT appear to feature names like 'Scanned Document,' 'Audio Recording,' 'Presentation,' and other names, which can be perceived as titles for office documents. The fake documents may have a double extension and be masquerade as a safe file using icons associated with Microsoft Office. For example, what appears to be a text file may be titled 'Report HG485.docx.exe' and trigger a User Account Control prompt on the screen as opposed to loading in Microsoft Word.
2. The Trojan-Dropper is observed to extract a copy of the Downeks threat, which we have seen in the past. The Downeks Trojan-Dropper connects to a hardcoded URL and downloads the main body of the QuasarRAT.
3. The QuasarRAT is installed on the system, and the attacker can access all data saved on the computer and connected network data storage. Additionally, the attacker can use QuasarRAT to install third-party software, remove programs, terminate processes and take screenshots.

That is not the full range of operations the remote user can perform. Malware investigators add that the QuasarRAT operators could download files, edit the Registry, open remote desktop connections, collect passwords, load Web pages, issue commands to the keyboard and mouse. Cybersecurity experts discovered that the QuasarRAT threat exhibits vulnerabilities regarding the client-server communication. The vulnerabilities could be exploited and allow the infected PC user to launch a counterattack and install a copy of QuasarRAT on the 'Command and Control' servers used by the first attacker potentially. It is not a good idea to remove the QuasarRAT manually and attempt counterattacks if you are not a computer security expert with experience under your belt. Regular PC users are encouraged to use a reputable anti-malware solution to eliminate the QuasarRAT and block unauthorized connections to the system.

Table of Contents

1

SpyHunter Detects & Remove QuasarRAT