ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of Quasar RAT, a remote access trojan that enables adversaries to establish persistent control over compromised endpoints for data exfiltration and lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy infections that may evade standard signature-based detections, allowing the SOC to isolate affected assets before the attacker leverages the RAT for further post-exploitation activities.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 14 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Quasar RAT
let malicious_domains = dynamic(["mb66.coupons", "ga888.free", "mb66a.me", "789bet.doctor", "8chicharrara.sa.com", "ijdo-ydo.nl", "fly88gg.st", "sulebet.live", "mb66.pizza", "dafacodabac52.fit", "mb663rd.com", "nchmct.info", "sc88b.bet", "79king.to"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

• Legitimate Software Updates via Quasar’s Native Updater

  • Scenario: Many enterprise applications (e.g., Zoom, Slack, Adobe Creative Cloud) use a background service or scheduled task to check for and download updates. If the update server or the local binary path matches a known Quasar IOC hash or URL pattern (often due to shared infrastructure or generic naming conventions like update.exe or quasar-service), the rule may trigger.
  • Filter/Exclusion: Exclude processes where the parent process is a known updater service (e.g., ZoomUpdater.exe, AdobeUpdateService.exe) or where the executable path resides in a standard software directory (e.g., C:\Program Files\Zoom\, C:\Program Files (x86)\Adobe\).

• Developer Testing with Quasar Framework

  • Scenario: Developers or QA engineers may use the open-source Quasar Framework (a Vue.js UI framework) for web application development. The framework’s development server or build tools might create files or network connections that match Quasar RAT IOCs, especially if the project folder is named quasar or if the dev server binds to a port listed in the IOC set.
  • Filter/Exclusion: Exclude events where the user account belongs to a developer or QA group (e.g., AD\DevTeam, AD\QAEngineers) and the process path contains node_modules, quasar-cli, or is associated with npm/yarn execution.

• Scheduled Backup or Sync Jobs

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) or file sync tools (e.g., Dropbox Business, OneDrive for Business) may run scheduled tasks that execute binaries with names resembling Quasar IOCs (e.g., quasar-sync, `qu