QuasarRAT - Daily Threat Report

Thursday, April 23, 2026

Daily Summary

QuasarRAT activity dropped notably on 2026-04-23, with 3 new samples detected versus the 7-day average of 4, representing a 32% decline. This decline continues a cooling trend observed over the past several days with no new C2 servers or geographic clustering identified.

New Samples Detected

All three samples are executable binaries: two .exe files and one .bin. The .bin file is less common for QuasarRAT and may indicate an attempt to bypass static analysis or repackaging for downloader-style delivery. No regional targeting is evident from available metadata.

Distribution Methods

The mix of .exe and .bin files suggests multiple delivery vectors. The .bin file could be dropped via script-based downloaders (e.g., PowerShell or VBS) while .exe samples likely arrive via phishing attachments or trojanized software downloads. Lack of regional data points to broad, untargeted campaigns.

Detection Rate

Based on typical QuasarRAT signatures, detection rates for standard .exe variants remain high, but the .bin file may have lower initial detection as it requires unpacking. Operators may be testing lightly obfuscated binaries to evade signature-based engines.

C2 Infrastructure

No new C2 servers were reported today, and no new domains or IPs were added to tracking. This absence suggests either a lull in operations or reliance on existing infrastructure. No geographic shift in C2 locations is observable.

7-Day Trend

Activity is cooling steadily; today’s count (3) is below the 7-day average (4) and marks the third consecutive day below average. This may reflect operators rotating to other families or going dormant.

Security Analysis

The .bin file inclusion is unusual for QuasarRAT. Historically, this family favors .exe and .scr files for direct execution. The .bin format may indicate delivery via stager malware that writes the payload to disk, possibly from a memory-only dropper. This slight shift suggests evasion testing against disk-scanning AV. Defensive recommendation: enable behavioral detection for processes that write .bin files to disk and immediately execute them, especially from browser or email client directories. Also review PowerShell and WMI activity logs for signs of in-memory loader chains.

Further Reading

Data Sources

MalwareBazaar (abuse.ch) ThreatFox (abuse.ch) URLhaus (abuse.ch)

More QuasarRAT Reports

Recent Malware Reports