^[3][4]

QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.^[5]

If theQuasarRAT client process does not have administrator privileges it will add a registry key toHKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.^[1][5]

QuasarRAT can launch a remote shell to execute commands on the victim’s machine.^[1][5]

QuasarRAT can obtain passwords from common FTP clients.^[1][2]

QuasarRAT can obtain passwords from common web browsers.^[1][2]

QuasarRAT can retrieve files from compromised client machines.^[5]

QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.^[1][2][5]

QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.^[5]

QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent stringMozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A thoughQuasarRAT can only be run on Windows systems.^[5]

QuasarRAT can download files to the victim’s machine and execute them.^[1][2]

QuasarRAT has a built-in keylogger.^[1][2]

QuasarRAT has a command to edit the Registry on the victim’s machine.^[1][5]

QuasarRAT can use TCP for C2 communication.^[5]

QuasarRAT can use port 4782 on the compromised host for TCP callbacks.^[5]

QuasarRAT can communicate over a reverse proxy using SOCKS5.^[1][2]

QuasarRAT has a module for performing remote desktop access.^[1][2]

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.^[2][5]

AQuasarRAT .dll file is digitally signed by a certificate from AirVPN.^[2]

QuasarRAT can gather system information from the victim’s machine including the OS type.^[1]

QuasarRAT can determine the country a victim host is located in.^[5]

QuasarRAT has the ability to enumerate the Wide Area Network (WAN) IP through requests to ip-api[.]com, freegeoip[.]net, or api[.]ipify[.]org observed with user-agent stringMozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0.^[5]

QuasarRAT can enumerate the username and account type.^[5]

QuasarRAT can obtain passwords from FTP clients.^[1][2]

QuasarRAT can perform webcam viewing.^[1][2]

^[3][2]

^[6]

^[7]

^[8][9]

^[10][11][4]

^[12]