Procedure examples

QuasarRAT can retrieve files from compromised client machines.

APT-C-36 used a customized version of QuasarRAT to monitor browser windows for strings relating to specific Colombian financial institutions.

QuasarRAT has the ability to enumerate the Wide Area Network (WAN) IP through requests to ip-api[.]com, freegeoip[.]net, or api[.]ipify[.]org observed with user-agent string `Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0`.

QuasarRAT has a module for performing remote desktop access.

QuasarRAT can enumerate the username and account type.

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.

QuasarRAT has a built-in keylogger.

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

QuasarRAT can gather system information from the victim’s machine including the OS type.

QuasarRAT can communicate over a reverse proxy using SOCKS5.

QuasarRAT can use TCP for C2 communication.

QuasarRAT can download files to the victim’s machine and execute them.

QuasarRAT has a command to edit the Registry on the victim’s machine.

QuasarRAT can perform webcam viewing.

If the QuasarRAT client process does not have administrator privileges it will add a registry key to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.

QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.

QuasarRAT can obtain passwords from FTP clients.

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.

QuasarRAT can obtain passwords from common FTP clients.

QuasarRAT can obtain passwords from common web browsers.

QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.

QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.

QuasarRAT can use port 4782 on the compromised host for TCP callbacks.

QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.

QuasarRAT can determine the country a victim host is located in.