Quasar RAT

Malware Family

1 786 indicators of compromise attributed to Quasar RAT across abuse.ch threat intelligence feeds.

Domains

1 241

IPs

409

URLs

Hashes

107

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Botnet C&CpayloadPayload Delivery

Indicator	Type
vinayaknashikdhol.in.net	domain
xn--h1agd3a1be.ru.com	domain
nowof.ddns.net	domain
f168.ing	domain
omnisec-33243.portmap.host	domain
yrbbksfa78.localto.net	domain
789f.ae.org	domain
www.wav92f55.shop	domain
www.nmhmbc3z.shop	domain
sainienterprises.in.net	domain
88clb8.io	domain
photography.za.com	domain
xltv.livebytexscore.com	domain
jobsosvid.gb.net	domain
s666.ae.org	domain
malware.kx5official.com	domain
hyrxmd.ru.com	domain
moviehub.in.net	domain
scan.codeeye.in.net	domain
aviele.gb.net	domain
88.218.170.77	ip
169.58.23.30	ip
134.122.200.217	ip
8.138.83.40	ip
188.132.165.148	ip
157.15.125.134	ip
39.99.25.80	ip
202.181.188.64	ip
38.97.56.198	ip
186.169.78.50	ip
43.228.126.197	ip
222.255.215.8	ip
154.201.70.163	ip
104.21.89.241	ip
212.56.35.232	ip
85.137.56.145	ip
18.140.203.160	ip
94.26.106.198	ip
49.228.131.165	ip
62.171.173.61	ip
https://gamesocialunder.it.com:8443	url
https://gamesocialunder.it.com:80	url
https://kvr.uk.com:3306	url
https://kvr.uk.com:8080	url
https://kvr.uk.com:8443	url
https://kvr.uk.com:80	url
https://nivad.io/vi-vn:3306	url
https://nivad.io/vi-vn:443	url
https://nivad.io/vi-vn:8080	url
https://nivad.io:8443	url
https://nivad.io:80	url
https://buddhasartworld.in.net:4782	url
https://buddhasartworld.in.net	url
https://style365.in.net:4782	url
https://bajajallianz.in.net:4782	url
https://bajajallianz.in.net	url
https://clubamericanista.com.mx	url
https://ehc.sa.com/	url
https://giaoduch.com	url
https://suj.uk.com	url

Another file to check? Run a file hash reputation check.