Daily Summary
QuasarRAT sample collection reached 7 new samples on 2026-09-13, roughly 2.3x the 7-day average of 3. This is the highest single-day count in the current tracking window and continues a rising trajectory that has been building over the past several days. No new C2 infrastructure was registered, meaning the increased sample volume draws on existing command-and-control capacity rather than a fresh buildout.
New Samples Detected
The file type split is heavily weighted toward compiled binaries: 6 of 7 samples are .exe, with a single .bat file rounding out the set. The presence of a batch file alongside PE executables suggests a hybrid delivery chain, where a script serves as a first-stage loader or persistence mechanism before dropping the primary QuasarRAT payload. This pattern is common in commodity RAT distribution, where operators lean on living-off-the-land scripting to reduce detection surface before committing the binary to disk.
7-Day Trend
Today’s count sits well above the 7-day average, a deviation large enough to treat as a genuine surge rather than noise. Across the window, volume has trended upward, and today’s peak reinforces that direction. Notably, the surge is not accompanied by new C2 servers, which points to a single operator or affiliate group scaling distribution over established infrastructure rather than multiple independent actors spinning up separate campaigns.
IOC Highlights
All 7 samples produced new indicators, but with zero new C2 servers, those IOCs are likely host-based artifacts: file hashes, mutexes, registry keys, and dropped file paths rather than network-based domains or IPs. For defenders, this shifts detection priority toward endpoint telemetry and process lineage rather than DNS or proxy blocklists.
Security Analysis
The combination of rising sample volume with static C2 infrastructure is a meaningful signal. When operators reuse the same C2 while pushing more samples, it typically indicates an active distribution campaign relying on volume to overwhelm filtering, rather than a new capability or variant. This mirrors patterns seen in commodity QuasarRAT campaigns that rotate delivery lures (often invoice or resume themes) while keeping backend infrastructure constant. The absence of new C2 across a volume spike argues against a fresh variant and toward operational scaling. Defensively, since network indicators are stale but plentiful, prioritize behavioral detections over static blocklists: alert on batch files spawning unsigned PE executables, on processes writing to user-writable directories that then establish outbound connections, and on the parent-child lineage of script interpreters launching unknown binaries. Feed today’s 7 endpoint IOCs into EDR hash and mutex watchlists, but expect the C2 layer to remain a known quantity until operators rotate infrastructure.