Quasar RAT

Malware Family

1 563 indicators of compromise attributed to Quasar RAT across abuse.ch threat intelligence feeds.

Domains

1 138

IPs

336

URLs

28

Hashes

61

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (1 138)IPs (336)URLs (28)Hashes (61)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&Cpayload

Sample indicators

IndicatorType
dnuocc.comdomain
debttoequity.africa.comdomain
dzone.in.netdomain
mainmenuflo.ydns.eudomain
magento.cn.comdomain
terminal.eu.comdomain
ddos.colatv88xb.ccdomain
c168-c168a.comdomain
bjam.in.netdomain
bkadbx.za.comdomain
foxclinicwholesale.comdomain
xn--ipw0kz64cfxg.jp.netdomain
sagestream.sa.comdomain
malware.xoilac365xp.tvdomain
x88.diydomain
dola789upn.comdomain
ryandp-63686.portmap.hostdomain
pbucz.sa.comdomain
www.n8hpa3ie.shopdomain
venomrat.comdomain
172.111.143.242ip
94.154.32.204ip
62.60.226.168ip
91.192.100.36ip
103.238.74.98ip
45.139.104.161ip
140.245.10.127ip
172.111.134.122ip
212.56.35.232ip
174.160.220.252ip
103.106.188.253ip
80.83.26.230ip
193.149.29.121ip
37.203.105.108ip
45.43.163.233ip
109.241.233.244ip
80.96.113.95ip
194.59.31.123ip
202.95.14.133ip
15.235.172.216ip
https://gamesocialunder.it.com:3306url
https://gamesocialunder.it.com:8443url
https://gamesocialunder.it.com:8080url
https://kvr.uk.com:3306url
https://kvr.uk.com:8443url
https://kvr.uk.com:80url
https://nivad.io/vi-vn:3306url
https://nivad.io/vi-vn:8443url
https://nivad.io/vi-vn:8080url
https://nivad.io/vi-vn:80url
https://nivad.io:8443url
https://nivad.io:8080url
https://buddhasartworld.in.neturl
https://style365.in.net:4782url
https://style365.in.neturl
https://bajajallianz.in.net:4782url
https://clubamericanista.com.mxurl
https://ehc.sa.com/url
https://suj.uk.comurl
https://top88fun.mobiurl