[New post] 100 Days of YARA – Day 13: Quasar RAT

Daniel posted: " While browsing Malware Bazaar, I saw some recent uploads of Quasar RAT samples. I encounter this RAT at work sometimes. https://bazaar.abuse.ch/browse/tag/QuasarRAT/ The Quasar project has been active for a while on GitHub: https://github.com/quasar/" Respond to this post by replying above this line New post on DMFR SECURITY 100 Days of YARA – Day 13: Quasar RAT by Daniel While browsing Malware Bazaar, I saw some recent uploads of Quasar RAT samples. I encounter this RAT at work sometimes. https://bazaar.abuse.ch/browse/tag/QuasarRAT/ The Quasar project has been active for a while on GitHub: https://github.com/quasar/Quasar Here are some links that I have bookmarked and tagged as quasarrat which may be interesting: https://pinboard.in/u:droberson/t:quasarrat/ rule quasar_rat { meta: description = "Quasar RAT" reference = "https://github.com/quasar/Quasar" strings: $ = "GetKeyloggerLogsResponse" $ = "GetKeyloggerLogsDirectoryResponse" condition: uint16(0) == 0x5a4d and any of them } YARA Rules Index Daniel | January 1, 2022 at 10:00 am | Tags: C#, malware, quasarrat, yara | Categories: 100 days of Yara | URL: https://wp.me/p8aFuC-2eG Comment    See all comments    Like Unsubscribe to no longer receive posts from DMFR SECURITY. Change your email settings at Manage Subscriptions. Trouble clicking? Copy and paste this URL into your browser: http://dmfrsecurity.com/2022/01/01/100-days-of-yara-day-13-quasar-rat/ Thanks for flying with WordPress.com