ThreatFox: Quasar RAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the deployment of Quasar Remote Access Trojan (RAT) indicators to establish persistent command-and-control channels and exfiltrate sensitive data. Proactively hunting for these specific IOCs within Azure Sentinel is critical to detect early-stage compromise before the malware leverages its full capabilities for lateral movement and credential theft.

IOC Summary

Malware Family: Quasar RAT Total IOCs: 5 IOC Types: sha256_hash, ip:port, md5_hash, sha1_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Quasar RAT
let malicious_ips = dynamic(["194.59.31.123", "209.25.141.24"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["194.59.31.123", "209.25.141.24"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Quasar RAT
let malicious_hashes = dynamic(["8c00b490332ca6af591294e1b2ffd01e708c612f", "2549dc1f259917a6179f726de0ed45e7", "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Quasar RAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Quasar RAT IOCs detection rule, tailored for an enterprise environment:

• Endpoint Security Scanning of Quarantine Archives

  • Scenario: The organization’s Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep scan of the “Quarantine” folder. This process extracts and analyzes archived malware samples from previous incidents, which may contain legacy Quasar RAT signatures that match the current IOC list but are benign historical artifacts.
  • Suggested Filter: Exclude file paths containing \ProgramData\Microsoft\Windows Defender\Scans\Quarantine or specific EDR service accounts (e.g., NT SERVICE\MsMpEng) from triggering alerts on these specific IOCs, as the context indicates a controlled scanning operation rather than active infection.

• Software Supply Chain Updates via Configuration Management

  • Scenario: The IT Operations team utilizes Ansible or SCCM (System Center Configuration Manager) to deploy a critical security patch for a third-party application suite (e.g., updating the Zoom Workplace SDK). During this deployment, the configuration management tool downloads and unpacks installer packages that include shared libraries known to share hash signatures with Quasar RAT components.
  • Suggested Filter: Create an exclusion based on the parent process name ccmexec.exe (SCCM) or ansible-runner, combined with a whitelist of specific file hashes associated with the approved software update package version being deployed that day.

• Automated Threat Intelligence Feed Synchronization

  • Scenario: The Security Operations Center runs a nightly job using Splunk Enterprise Security or Tenable.io to ingest and cross-reference external threat intelligence feeds. This process involves downloading raw IOC lists (STIX/TAXII formats