ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt targets the presence of known Quasar RAT indicators, which are frequently used by adversaries to establish persistent remote access and execute command-and-control operations. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised endpoints early, mitigating the risk of data exfiltration or lateral movement before the malware can fully establish its foothold.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 6 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Quasar RAT
let malicious_domains = dynamic(["kissmyaster.co", "mb66b5.com", "cupfee.me", "bigjackpot.casino", "mb6606.org", "789betpg.bet"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

• Legacy Java Application Deployment: Quasar RAT often uses specific Java class names or file paths (e.g., Quasar.class, loader.jar) for its dropper. In a large enterprise, deploying legacy Java-based middleware, internal tools, or third-party SDKs that happen to use generic naming conventions like loader.jar or quasar.jar (used by the Quasar framework for concurrency) can trigger the file hash or name-based IOCs.

  • Filter/Exclusion: Exclude files located in standard Java application directories (e.g., C:\Program Files\Java\, C:\app\lib\) or specific known application roots (e.g., C:\Tomcat\lib\). Additionally, exclude hashes associated with verified internal build artifacts or known vendor SDKs.

• Scheduled Maintenance Scripts: The IOCs may include specific registry keys (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) or scheduled task names used for persistence. Legitimate IT operations often create scheduled tasks for disk cleanup, log rotation, or backup verification that might coincidentally match the naming pattern or location of the Quasar persistence mechanism if the IOC is based on a generic task name or path.

  • Filter/Exclusion: Exclude scheduled tasks created by known service accounts (e.g., svc_backup, admin_ops) or tasks whose execution path points to standard system utilities (e.g., powershell.exe, cmd.exe) in system directories (C:\Windows\System32\).

• Development and Testing Environments: Developers testing Java-based applications or using the Quasar concurrency framework (a legitimate open-source project) may run instances of quasar.jar or related classes in development VMs or build agents. If the detection rule flags the presence of the Quasar framework’s core JAR files or specific class names, it will trigger on all