ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hypothesis targets the presence of Quasar RAT, a remote access trojan that grants adversaries persistent control to execute commands and exfiltrate data from compromised endpoints. Proactively hunting for these IOCs in Azure Sentinel is critical because Quasar RAT is frequently deployed in initial access chains, allowing attackers to establish a foothold and pivot laterally before traditional detections trigger.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 3 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`1f37d2345e765100b8dc628bb6ce098472891fe0`	payload	2026-09-08	95%
md5_hash	`b1ceadb93463f22943f9677aa330f15a`	payload	2026-09-08	95%
sha256_hash	`1b68d68b9fd200183c69084e91fe53bd5dca5c501bce1bbf1894034bc69fafe6`	payload	2026-09-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Quasar RAT
let malicious_hashes = dynamic(["1f37d2345e765100b8dc628bb6ce098472891fe0", "b1ceadb93463f22943f9677aa330f15a", "1b68d68b9fd200183c69084e91fe53bd5dca5c501bce1bbf1894034bc69fafe6"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Quasar RAT

False Positive Guidance

Legitimate Software Updates via Quasar-Branded Installers: Some niche remote management or support tools (e.g., specific builds of TeamViewer, AnyDesk, or custom internal IT support agents) may use file names or hash values that overlap with known Quasar RAT IOCs if they are signed by a vendor whose certificate or binary structure matches the threat feed.
- Filter/Exclusion: Exclude processes where the parent executable is a known signed installer (e.g., msiexec.exe, setup.exe from trusted publishers) or filter by specific trusted vendor names (e.g., TeamViewer.exe, AnyDesk.exe) if their binary hashes match the IOC list.
Scheduled Maintenance Jobs with Matching Binary Hashes: Internal scheduled tasks (e.g., Task Scheduler jobs running quasar_update.bat or a helper binary named quasar_helper.exe) used for log rotation, disk cleanup, or configuration syncs may trigger the rule if the binary’s SHA-256 hash matches a known Quasar RAT sample.
- Filter/Exclusion: Exclude events where the process path is under trusted directories (e.g., C:\Program Files\InternalTools\, C:\Scripts\Maintenance\) and the parent process is svchost.exe or taskeng.exe with a known trusted user account (e.g., DOMAIN\svc-maintenance).
Development/Testing Environments Running Quasar Samples: Developers or QA engineers testing RAT detection capabilities or running isolated lab environments may execute known Quasar RAT samples (e.g., quasar_rat.exe from a threat intelligence repo) on dev VMs or test servers.
- Filter/Exclusion: Exclude hosts tagged as dev, test, or lab in your CMDB or asset inventory, or filter by user accounts belonging to dev-team