ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

Hunt package for 4 IOCs associated with Quasar RAT

IOC Summary

Malware Family: Quasar RAT Total IOCs: 4 IOC Types: domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Quasar RAT
let malicious_domains = dynamic(["gbp.cn.com", "obf.uk.com", "akashmehndiandtattooart.in.net", "fly88-zz.site"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Quasar RAT