Description

In a recent report, Uptycs researchers found that the Quasar RAT, an open-source remote access trojan, employs DLL side-loading to remain concealed and quietly exfiltrate data from compromised Windows systems. This technique capitalizes on the trustworthiness of specific Windows files. The report also emphasizes the malware's use of ctfmon[.]exe and calc[.]exe in its attack process. Quasar RAT, known as CinaRAT or Yggdrasil, is a C#-based remote administration tool that collects system info, application lists, files, keystrokes, screenshots, and runs shell commands. Threat actors often employ DLL side-loading, hiding their payloads within DLL files named like legitimate programs.This enables adversaries to conceal their actions within a trusted and potentially elevated system or software process. The attack documented by Uptycs begins with an ISO image file containing three files: a genuine binary named ctfmon[.]exe, renamed as eBill-997358806[.]exe, a MsCtfMonitor[.]dll file renamed as monitor[.]ini, and a malicious MsCtfMonitor[.]dll. When the binary 'eBill-997358806[.]exe' is executed, it triggers the loading of the 'MsCtfMonitor[.]dll' (with its name disguised) using the DLL side-loading technique. This disguised DLL contains hidden code that includes another executable called "FileDownloader[.]exe." This executable is injected into Regasm[.]exe, the Windows Assembly Registration Tool, to initiate the next stage, which loads the authentic calc[.]exe file using DLL side-loading to launch the final Quasar RAT payload. Furthermore, the trojan creates connections to a remote server, sharing system details, and sets up a reverse proxy for remote access. The attacker's identity and initial access method remain uncertain, but phishing emails likely distribute the attack. This highlights the need for user caution with suspicious emails, links, and attachments.