ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt identifies potential Quasar RAT infections by correlating known indicators of compromise with asset telemetry, targeting a remote access tool frequently used for persistent command-and-control. Proactively hunting for these IOCs is critical because Quasar RAT enables adversaries to execute arbitrary commands and exfiltrate data, often serving as a foothold for deeper network compromise if left undetected.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 5 IOC Types: domain, sha1_hash, sha256_hash, md5_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["41.41.128.115"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["41.41.128.115"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Quasar RAT
let malicious_domains = dynamic(["update.ddns.net"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Quasar RAT
let malicious_hashes = dynamic(["cba5d54230e862787080f0b881f38b2f", "c16923aa6b647fe1b8e8b2879fc251e48d1f09b34351056d7afe83b18efcdbf6", "502d908a2040f5b23cbb087584247095c9cbb4a3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

• Scenario: A DevOps team deploys a custom internal build agent or CI/CD runner that reuses the same binary hash or IP address range as the Quasar RAT IOC list to optimize network latency within the internal data center.
  • Filter/Exclusion: Exclude assets tagged with env:production and role:ci-cd-agent, or specifically whitelist the internal IP subnet (e.g., 10.20.0.0/24) where the build farm resides.
• Scenario: An IT administrator performs a manual patching task using a legacy, unsigned management utility that shares the same SHA256 hash as one of the Quasar RAT binaries because it was forked from an older open-source base.
  • Filter/Exclusion: Exclude processes initiated by service accounts with the svc-admin group membership, or filter out events where the parent process is powershell.exe or cmd.exe and the user context is DOMAIN\svc-*.
• Scenario: A security engineer runs a YARA rule scan or memory dump analysis tool that temporarily loads the Quasar RAT sample (or a similar variant) into memory for testing purposes on a dedicated jump host.
  • Filter/Exclusion: Exclude hosts labeled role:security-testing or env:lab, and filter out events where the process name matches known analysis tools like volatility3 or yara.
• Scenario: A third-party vendor’s remote support tool (e.g., TeamViewer or ConnectWise) uses a shared communication port or IP endpoint that coincidentally matches the C2 IP in the ThreatFox IOC list during a scheduled maintenance window.
  • Filter/Exclusion: Exclude connections where the source port is in the range 49152-65535 (ephemeral) and the