Quasar RAT

Quasar RAT is an open-source .NET remote administration tool first released in 2014 as xRAT, renamed to Quasar in August 2015 by developer MaxXor. Licensed under MIT, the GitHub repository has been forked over 900 times. Its source availability and full feature set have made it one of the most commonly adopted RATs by both commodity operators and state-sponsored groups.

The C2 protocol uses raw TCP (default port 4782) with Protocol Buffers v3 serialization and AES-256 encryption in CBC mode. Keys are derived via PBKDF2 with a hardcoded salt embedded at build time. Later versions wrap traffic in TLS using a self-signed certificate with default subject "Quasar Server CA". The initial server-to-client packet is a fixed 68 bytes, which is the strongest network detection signature.

Capabilities include remote desktop, keylogging with window-title context, file management, webcam and screen capture, credential recovery from browsers, remote shell, registry editing, reverse proxy, and download-and-execute for secondary payloads. Persistence uses scheduled tasks and registry run keys.

Quasar has been picked up by a wide range of threat actors. APT10/Stone Panda used custom builds with in-memory .NET loading against EMEA targets. Patchwork/Dropping Elephant delivered it via RTF exploits to US policy think tanks. Blind Eagle/APT-C-36 runs a customized "BlotchyQuasar" variant targeting Colombian financial institutions with banking-specific keylogging. Gorgon Group, Kimsuky, and APT33 have also used it in espionage operations. The VERMIN campaign paired Quasar with custom malware to target Ukrainian government entities.

Delivery methods include spear-phishing with weaponized documents, DLL sideloading chains abusing trusted Windows binaries, image-based steganography hiding payloads in BMP/PNG pixel data, ISO images, and self-extracting archives with decoy documents.