H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Tool

QuasarRAT

[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)

Tool
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)

Labels

tool
32 recorded

Relationships

uses
from APT-C-36
Group
uses
from BackdoorDiplomacy
Group
uses
from Gorgon Group
Group
uses
from Kimsuky
Group
uses
from LazyScripter
Group
uses
from menuPass
Group
uses
from Patchwork
Group
uses
to Application Window Discovery
Technique
uses
to Bypass User Account Control
Technique
uses
to Code Signing
Technique
uses
to Credentials from Password Stores
Technique
uses
to Credentials from Web Browsers
Technique
uses
to Credentials In Files
Technique
uses
to Data from Local System
Technique
uses
to Hidden Files and Directories
Technique
uses
to Hidden Window
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Keylogging
Technique
uses
to Modify Registry
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Non-Standard Port
Technique
uses
to Proxy
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Remote Desktop Protocol
Technique
uses
to Scheduled Task
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Information Discovery
Technique
uses
to System Location Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Video Capture
Technique
uses
to Windows Command Shell
Technique
7 external

References

mitre-attack
S0262
open
QuasarRAT
—
xRAT
—
Securelist APT10 March 2021
https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/
open
TrendMicro Patchwork Dec 2017
https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf
open
GitHub QuasarRAT
https://github.com/quasar/QuasarRAT
open
Volexity Patchwork June 2018
https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance