While browsing Malware Bazaar, I saw some recent uploads of Quasar RAT samples. I encounter this RAT at work sometimes. https://bazaar.abuse.ch/browse/tag/QuasarRAT/

The Quasar project has been active for a while on GitHub: https://github.com/quasar/Quasar

Here are some links that I have bookmarked and tagged as quasarrat which may be interesting: https://pinboard.in/u:droberson/t:quasarrat/

rule quasar_rat
{
	meta:
		description = "Quasar RAT"
		reference = "https://github.com/quasar/Quasar"

	strings:
		$ = "GetKeyloggerLogsResponse"
		$ = "GetKeyloggerLogsDirectoryResponse"

	condition:
		uint16(0) == 0x5a4d and any of them
}

YARA Rules Index