The detection of suspicious strings associated with C#/VB Stealers and QuasarRat indicates potential exfiltration or credential theft activities by an adversary. SOC teams should proactively hunt for these strings in Azure Sentinel to identify early-stage malware execution and prevent data compromise.
YARA Rule
rule MSILStealer
{
meta:
description = "Detects strings from C#/VB Stealers and QuasarRat"
reference = "https://github.com/quasar/QuasarRAT"
author = "https://github.com/hwvs"
last_modified = "2019-11-21"
strings:
$ = "Firefox does not have any profiles, has it ever been launched?" wide ascii
$ = "Firefox is not installed, or the install path could not be located" wide ascii
$ = "No installs of firefox recorded in its key." wide ascii
$ = "{0}\\\\FileZilla\\\\recentservers.xml" wide ascii
$ = "{1}{0}Cookie Name: {2}{0}Value: {3}{0}Path" wide ascii
$ = "[PRIVATE KEY LOCATION: \\\"{0}\\\"]" wide ascii
condition:
1 of them
}
This YARA rule can be deployed in the following contexts:
Scenario: Legitimate scheduled job running PowerShell scripts that include base64 encoded strings
Filter/Exclusion: process.name == "schtasks.exe" || process.name == "powershell.exe" && (process.args contains "encoded" || process.args contains "base64")
Scenario: Admin using C# to create a custom script for log parsing that contains strings matching known stealer patterns
Filter/Exclusion: process.name == "devenv.exe" || process.name == "dotnet.exe" && (process.args contains "logparser" || process.args contains "script")
Scenario: System update process that includes VB.NET scripts for configuration changes with similar string patterns
Filter/Exclusion: process.name == "wuauclt.exe" || process.name == "msiexec.exe" && (process.args contains "update" || process.args contains "patch")
Scenario: Development environment using QuasarRat-related libraries for legitimate network monitoring tools
Filter/Exclusion: process.name == "VisualStudio.exe" || process.name == "QuasarMonitor.exe" && (process.args contains "monitor" || process.args contains "network")
Scenario: Automated backup process that uses C# scripts with string patterns similar to known stealer payloads
Filter/Exclusion: process.name == "backup.exe" || process.name == "robocopy.exe" && (process.args contains "backup" || process.args contains "archive")