QuasarRAT

First seen

2014-01-01 00:00:00

Malware type

rat

Family

Malware family

Operating systems

windows

Related IoCs

7130 (3633 malicious)

Last IoC activity

2026-10-17 03:07:31

Profile updated

2026-07-07 12:48:02

Targeted industries: government-and-public-sector technology-and-telecommunications financial-services education-and-nonprofits

Context

QuasarRAT is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. QuasarRAT is developed in the C# language.

Recent IoC activity

3,631 malicious indicators in Maltiverse are attributed to QuasarRAT (S0262). The 20 most recently updated:

Detection coverage

• 3 YARA rules
• 474 Sigma rules

Malware & tools used

• Remote Desktop Protocol (attack-pattern)
• Keylogging (attack-pattern)
• Symmetric Cryptography (attack-pattern)
• Credentials from Web Browsers (attack-pattern)
• Registry Run Keys / Startup Folder (attack-pattern)
• Hidden Window (attack-pattern)
• System Information Discovery (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• System Location Discovery (attack-pattern)
• Modify Registry (attack-pattern)
• Hidden Files and Directories (attack-pattern)
• System Owner/User Discovery (attack-pattern)
• Bypass User Account Control (attack-pattern)
• Data from Local System (attack-pattern)
• Non-Application Layer Protocol (attack-pattern)
• System Network Configuration Discovery (attack-pattern)
• Credentials from Password Stores (attack-pattern)
• Credentials In Files (attack-pattern)
• Windows Command Shell (attack-pattern)
• Proxy (attack-pattern)
• Non-Standard Port (attack-pattern)
• Code Signing (attack-pattern)
• Application Window Discovery (attack-pattern)
• Scheduled Task (attack-pattern)
• Video Capture (attack-pattern)

Used by threat actors

• Kimsuky (threat-actor)
• Gorgon Group (threat-actor)
• APT-C-36 (threat-actor)
• Patchwork (threat-actor)
• LazyScripter (threat-actor)
• menuPass (threat-actor)
• Kimsuky (threat-actor)
• BackdoorDiplomacy (threat-actor)

Detection rules

• CAPE_Quasarrat (yara-rule)
• CAPE_Quasarrat_Kingrat (yara-rule)
• SEKOIA_Implant_Win_Quasarrat (yara-rule)

Related threat objects

• Quasar RAT (malware)

Reports & references

• volexity.com — Patchwork Apt Group Targets Us Think Tanks (report)
• Trend Micro — Tech Brief Untangling The Patchwork Cyberespionage Group (report)
• Kaspersky — 101519 (report)
• MITRE ATT&CK — S0262 (report)
• github.com — Quasarrat (report)

External references

• mitre-attack — S0262
• QuasarRAT
• xRAT
• Securelist APT10 March 2021
• TrendMicro Patchwork Dec 2017
• GitHub QuasarRAT
• Volexity Patchwork June 2018
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy