Quasar RAT is an open-source remote access trojan written in Microsoft's .NET framework that has been actively used by cybercriminals and threat actors since its public release. Unlike many malware families that are sold on underground forums, Quasar's source code is freely available on GitHub, which has led to widespread adoption and countless customized variants. This accessibility makes it a persistent threat—attackers of all skill levels can deploy it, often wrapping it in packers or obfuscators to evade antivirus detection. If you're seeing unfamiliar network connections, programs running at startup that you don't recognize, or suspicious remote desktop activity, Quasar may have established a foothold on your system.
Threat Profile
| Attribute | Details |
|---|---|
| Primary Name | Quasar RAT |
| Known Aliases | CinaRAT, QuasarRAT, Yggdrasil |
| Platform | Windows (all versions from XP through 11) |
| File Type | Windows PE executable (.exe), typically .NET assembly |
| Source Code | Publicly available on GitHub (open source) |
| First Observed | Approximately 2014 (widespread adoption 2015–present) |
| Distribution Method | Phishing attachments, drive-by downloads, bundled with cracked software, exploit kits |
| Primary Capability | Full remote administration—keylogging, screen capture, webcam/microphone access, file manipulation, process control |
| Persistence Mechanism | Registry Run keys, scheduled tasks, startup folder entries |
| Common Obfuscation | Packed with ConfuserEx, .NET Reactor, or similar .NET obfuscators to evade static analysis |
| Typical Payload Size | 200 KB – 1.5 MB (varies with packing and embedded plugins) |
| Detection Difficulty | Moderate to high—many AV engines detect base variants, but custom builds and packed versions often slip through |
How It Spreads
Quasar RAT spreads through a variety of social-engineering and technical vectors. Because the source code is publicly available, attackers customize the builder to generate unique executables, which means each campaign may look different on the wire. The most common entry point we see at the shop is a phishing email with a malicious attachment—often a ZIP archive containing an executable disguised as a PDF or Office document. Once the victim double-clicks the file, the malware installs silently in the background while displaying a decoy document or error message.
Another popular distribution method is bundling Quasar with pirated software and key generators. Users searching for "free" versions of expensive applications download an installer that contains both the legitimate program and the RAT. Because these downloads often come from shady forums or torrent sites, users already have their guard down. Drive-by downloads from compromised websites and exploit kits targeting outdated browser plugins (Flash, Java, Silverlight) also deliver Quasar, though these vectors have become less common as browsers have tightened security.
- Phishing emails with malicious Office macros or executable attachments
- Malicious ZIP/RAR archives containing renamed .exe files (e.g., "Invoice_July.pdf.exe")
- Trojanized installers for cracked software, games, or key generators
- Drive-by downloads from compromised or malicious websites
- Exploit kits targeting unpatched browser or plugin vulnerabilities
- USB/removable media infections with auto-run payloads (less common, but still observed)
What It Does On Your Machine
Quasar is a full-featured remote access tool. Once running, it establishes a connection to the attacker's command-and-control (C2) server—often a dynamic DNS hostname or a compromised legitimate server. The attacker then has a graphical interface showing your machine in a list of infected hosts, with real-time status updates. From this interface, they can execute nearly any action you could perform yourself: browse your files, launch programs, capture keystrokes, record your screen, activate your webcam, and even open a remote desktop session that mirrors your display.
The malware typically installs itself in a hidden or system-sounding directory and creates multiple persistence mechanisms to survive reboots. We frequently see it copy itself to %AppData%\Roaming\Microsoft\Windows\Templates\ or %LocalAppData%\ subfolders, then add registry keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or schedule tasks via the Windows Task Scheduler. Because Quasar is written in .NET, it requires the .NET Framework to run (which is already installed on most Windows systems), and it often runs as a background process with no visible window.
Behavioral IOCs observed in sandbox analysis include outbound TCP connections on non-standard ports (commonly 4782, 1604, or random high ports), DNS queries to dynamic DNS providers (no-ip.org, duckdns.org, etc.), and the creation of mutex objects to ensure only one instance runs at a time. The malware also hooks into Windows APIs to capture keystrokes system-wide and can inject code into legitimate processes to hide its network activity.
The attacker can also use Quasar to download and execute additional payloads—ransomware, cryptocurrency miners, credential stealers—turning your machine into a platform for multiple threats. We've seen cases where Quasar was the initial foothold, followed days later by a full ransomware deployment that encrypted the entire network once the attacker mapped out shared drives and backup locations.
Manual Removal — Step by Step
Disconnect from the Internet
Unplug your Ethernet cable or turn off Wi-Fi. This breaks the attacker's real-time connection and prevents the malware from downloading additional components or exfiltrating data while you work.
Boot into Safe Mode with Networking
Restart your computer and press F8 (or Shift+F8 on newer systems) during boot to access the Advanced Boot Options menu. Select "Safe Mode with Networking." This loads Windows with minimal drivers and prevents most malware from auto-starting, while still allowing you to download tools.
Run a Full Scan with Malwarebytes
Download and install Malwarebytes Free from malwarebytes.com (do this from a clean machine or while in Safe Mode if possible). Update the definitions and run a full "Threat Scan." Malwarebytes has good detection for Quasar and its packed variants. Quarantine all detected items.
Manually Inspect Startup Locations
Press Win+R, type msconfig, and press Enter. Go to the "Startup" tab (or click "Open Task Manager" on Windows 10/11). Look for unfamiliar entries—especially those with random names, missing publisher info, or paths in %AppData% or %Temp%. Disable suspicious items. Cross-reference the file paths by right-clicking and selecting "Open file location."
Check Scheduled Tasks
Open Task Scheduler (search "Task Scheduler" in the Start menu). Expand "Task Scheduler Library" and look through the list for tasks you didn't create. Quasar often schedules itself to run at login or every few minutes. Right-click suspicious tasks and select "Delete." Note the "Actions" tab to see which executable the task runs.
Clean the Registry
Press Win+R, type regedit, and press Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries pointing to executables in suspicious locations (AppData, Temp, Windows\Templates). Right-click and delete the entries. Be cautious—do not delete legitimate Windows or application entries.
Delete the Malware Files
Navigate to the file paths you identified in steps 4–6. Common locations: %AppData%\Roaming\Microsoft\Windows\Templates\, %LocalAppData%\Temp\, or subfolders named after legitimate services. Delete the executables. If Windows says the file is in use, use Unlocker (a free utility) or boot into Safe Mode to remove it.
Reset Browsers and Clear Temp Files
Quasar itself doesn't typically modify browsers, but attackers may have installed additional extensions or hijackers. Reset your browsers to default settings (Chrome, Firefox, Edge all have a "Restore settings to their original defaults" option). Then use Disk Cleanup (search "Disk Cleanup" in Start) to delete temporary files, which may contain dropper remnants.
Change All Passwords from a Clean Device
Because Quasar includes keylogging, assume the attacker captured any passwords you typed while infected. From a known-clean computer or phone, change your email, banking, and any other important account passwords. Enable two-factor authentication wherever possible.
Reboot Normally and Monitor
Restart your computer in normal mode and observe behavior. Check Task Manager (Ctrl+Shift+Esc) for unfamiliar processes and Resource Monitor for unexpected network connections. Run a second scan with a different tool (such as ESET Online Scanner or Windows Defender Offline) to confirm the system is clean.
Prevention
- Never open email attachments from unknown senders. Even if the sender looks familiar, verify by calling or texting them directly if the email seems unexpected. Quasar campaigns often spoof legitimate contacts.
- Avoid downloading software from torrent sites, file-sharing platforms, or unofficial sources. Stick to vendor websites and the Microsoft Store. If you need free software, research it first and download from the official project page.
- Keep Windows and all applications up to date. Enable automatic updates for Windows, Office, browsers, and especially Java/Flash (or better yet, uninstall Java and Flash if you don't need them). Most exploit-kit infections target outdated software.
- Use a reputable antivirus with real-time protection. Windows Defender is acceptable for basic use, but consider a third-party solution like Bitdefender, Kaspersky, or ESET for better heuristic detection of packed .NET malware.
- Enable "Show file extensions" in Windows Explorer. Go to Folder Options → View tab → uncheck "Hide extensions for known file types." This makes it much easier to spot files like "Invoice.pdf.exe" that are pretending to be documents.
- Implement network-level protections. If you run a small business, configure your router or firewall to block outbound connections to known dynamic DNS providers (unless you use them) and monitor for unusual outbound traffic on non-standard ports.
- Educate everyone who uses your computer or network. Many Quasar infections happen because a family member or employee clicked a malicious link. A five-minute conversation about phishing can save hours of remediation work.
- Regular backups to an offline or cloud destination. While Quasar itself isn't ransomware, attackers often deploy ransomware after gaining access via a RAT. Keep current backups that are not continuously connected to your PC.
Bring It In
Quasar RAT is one of those infections that can be deceptively difficult to remove completely. Because each attacker customizes the builder, the file names, registry keys, and network indicators change from one sample to the next. The manual steps above will work for many cases, but if you're not confident working in the registry or Task Scheduler—or if the infection keeps coming back after you think you've removed it—bring your computer to our Roswell shop. We use a combination of professional-grade scanning tools, behavioral analysis, and forensic techniques to make sure every trace is gone. We'll also check for secondary infections (cryptominers, credential stealers, backdoors) that may have been deployed by the attacker while they had access.
Call us at (770) 692-4342 or stop by 1000 Mansell Road in Roswell during business hours. We offer same-day diagnostics for malware cases, and most Quasar removals are completed within 24 hours. We'll also walk you through the prevention steps above and help you set up real-time monitoring so you can catch threats before they establish persistence. Don't let a remote access trojan turn your personal computer into someone else's surveillance tool—let's get it cleaned up and locked down today.