This hunt targets the presence of known Quasar RAT indicators of compromise, which adversaries deploy to establish persistent remote access and execute malicious commands within the environment. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised hosts before the attacker leverages the RAT for lateral movement, data exfiltration, or further payload delivery.
Malware Family: Quasar RAT Total IOCs: 18 IOC Types: ip:port, domain
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| domain | mb66.money | botnet_cc | 2026-09-17 | 100% |
| domain | mb669.win | botnet_cc | 2026-09-17 | 100% |
| domain | mb66d.pro | botnet_cc | 2026-09-17 | 100% |
| domain | mb661.click | botnet_cc | 2026-09-17 | 100% |
| domain | ga888.icu | botnet_cc | 2026-09-17 | 100% |
| domain | ok8368.io | botnet_cc | 2026-09-17 | 100% |
| ip:port | 31[.]220[.]89[.]57:19997 | botnet_cc | 2026-09-17 | 100% |
| domain | nyecoin.io | botnet_cc | 2026-09-17 | 100% |
| domain | mb66.contact | botnet_cc | 2026-09-17 | 100% |
| domain | mcw.appgame.fit | botnet_cc | 2026-09-17 | 100% |
| domain | www.mb6623.com | botnet_cc | 2026-09-17 | 100% |
| domain | www.sunwin1.bz | botnet_cc | 2026-09-17 | 100% |
| domain | www.sunwin28.bz | botnet_cc | 2026-09-17 | 100% |
| domain | jun88vn.bet | botnet_cc | 2026-09-17 | 100% |
| domain | ownqs.com-info.bid | botnet_cc | 2026-09-17 | 100% |
| domain | qs-work.com-info.bid | botnet_cc | 2026-09-17 | 100% |
| ip:port | 45[.]137[.]81[.]207:7210 | botnet_cc | 2026-09-17 | 100% |
| ip:port | 45[.]153[.]34[.]146:4782 | botnet_cc | 2026-09-17 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["31.220.89.57", "45.137.81.207", "45.153.34.146"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.220.89.57", "45.137.81.207", "45.153.34.146"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Quasar RAT
let malicious_domains = dynamic(["mb66.money", "mb669.win", "mb66d.pro", "mb661.click", "ga888.icu", "ok8368.io", "nyecoin.io", "mb66.contact", "mcw.appgame.fit", "www.mb6623.com", "www.sunwin1.bz", "www.sunwin28.bz", "jun88vn.bet", "ownqs.com-info.bid", "qs-work.com-info.bid"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario: An IT administrator deploys a custom PowerShell script to the domain to enforce a new security policy, which includes a hardcoded IP address (e.g., 192.168.10.5) for a local monitoring agent or log shipper that coincidentally matches one of the 18 Quasar RAT IOCs.
powershell.exe or pwsh.exe and the parent process is a known administrative tool like Task Scheduler (taskschd.msi) or Group Policy (gpupdate.exe), or specifically exclude the IP address if it is documented in the internal CMDB as a trusted internal service.Scenario: A developer runs a local test harness or a CI/CD pipeline job that uses a generic port (e.g., 4444 or 8080) for inter-process communication between a build agent and a local database instance, matching a Quasar RAT default port IOC.
msbuild.exe, dotnet.exe, java.exe) and the destination port is within the range of standard development ports (e.g., 8000-8100), or exclude if the connection is loopback (127.0.0.1) or within the same subnet as the build farm.Scenario: A legacy application or a specific vendor’s agent (e.g., a backup client or an APM tool) uses a specific User-Agent string or a known hash value in its update check mechanism that overlaps with a Quasar RAT IOC (e.g., a specific SHA256 hash of a common library).