QuasarRat malware
Quasar is an open-source .NET remote administration tool frequently abused as a RAT. Its configuration (C2 hosts, install path, mutex, startup key) is encrypted in the assembly.
Malva.RE has analysed 245 public samples tagged QuasarRat, statically and without execution. The latest public sample was seen on 2026-10-21.
File types
- PE Executable38
- PowerShell1
- ZIP Archive1
Recurring C2 endpoints
patri00-42082[.]portmap[.]host1c2[.]ethanremote[.]co[.]uk191[.]199[.]133[.]591upxdate[.]duckdns[.]org191[.]208[.]197[.]301176[.]160[.]157[.]96,uchiwa5[.]duckdns[.]org,mauvaise[.]duckdns[.]org,truesir[.]duckdns[.]org192[.]249[.]61[.]911213[.]142[.]133[.]1551au88-top[.]com1mqdfpy[.]sa[.]com1
Defanged. Extracted statically from the configurations of public samples.
Latest public QuasarRat samples
Analyse your own QuasarRat sample
Malva.RE unpacks, decompiles and extracts the configuration of suspicious files statically — the file is never executed. Free-plan reports are public.
Analyse a file for free