Malware
QuasarRAT
- First Reported
- Apr 4, 2024
- Latest Reported
- Oct 9, 2026
Reported Context (5)
- Rilevate infine diverse campagne italiane PureRat, QuasarRAT e StrRat e alcune generiche AgentTesla, PhantomStealer, ScreenConnect che hanno sfruttato i temi “Delivery”, “Documenti” e “Preventivo”. CERT-AGID Reports 178 Malicious Campaigns Targeting Italy in the Week of Oct. 3–9
- Its Windows post-compromise activity included the use of EfsPotato, QuasarRAT, BadIIS, ASHX web shells, Defender exclusions for IIS directories, a Google Chrome Start scheduled task, and rogue privileged accounts. Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited
- The Larva-24009 threat actor installs a PowerShell backdoor through LNK malware and subsequently maintains persistence by installing remote control tools such as QuasarRAT and UltraVNC. Larva-24009 Uses Phishing to Deploy PowerShell Backdoors and Steal Data
- Asia, Europe, and Africa, roughly 73% of all victims were attributed to infections involving AsyncRAT, QuasarRAT, and Cobalt Strike. According to Sophos' "Active Adversary Report" (1H 2024), Cobalt Strike was present HuntSQL Recipes Help Analysts Find and Track Cobalt Strike Infrastructure
- They use RotBot, a customized variant of QuasarRAT, and XClient stealer as payloads in the campaign we analyzed. CoralRaider Uses RotBot and XClient to Steal Credentials and Social Media Data
CVE (72)
Malware (18)
People (3)
Threat Actors (4)
MITRE ATT&CK (25)
Vendors (25)
Products (39)
Tools (14)
Industries (1)
Countries (13)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.