RAT
Open Source
.Net
Quasar is a remote access trojan (RAT) that allows attackers to control infected machines remotely. Written in .NET it’s an open source project for Microsoft Windows operating systems so it’s a popular tool in many attacks.
Quasar RAT has many capabilities that makes it a versatile tool for attackers. Keylogging, password stealing, screenshot, reverse proxy, file download and upload. Open source so you can customize it to fit your target or campaign.
Distribution Methods
Quasar is distributed through malicious spam emails (malspam) with infected attachments or links. Attackers also exploit publicly disclosed vulnerabilities to deploy Quasar as a secondary payload after initial compromise. Its open source nature has made it popular among many threat actors from novice hackers to APT groups.
Evasion Techniques
Quasar RAT can be packed or obfuscated to evade detection. Some attackers use DLL sideloading to run Quasar making detection harder. It can operate stealthily in the infected system to maintain persistence and prolonged unauthorized access.
Limit the use of remote administration tools and log all remote access sessions.
Monitor outbound traffic for unusual connections to known malicious IP.
Configure EDR to detect remote access tools and unusual system activity.
Block malspam campaigns that distribute Quasar RAT.