QuasarRAT
QuasarRAT is an open-source, remote access tool that has been publicly available on GitHub since at least 2014.
20New IOCs · 24h
48New IOCs · 7 days
763Indicators tracked
4Independent feeds
2026-10-11 16:10Last activity
New indicators per day
2026-09-29 to 2026-10-12, by first report.
- Domain5
- Hash33
- IP7
- TLS cert718
- C2730
- Malware33
MITRE ATT&CK lists this as tool QuasarRAT. Explore the ATT&CK matrix →
Where its infrastructure is hosted
Latest indicators
Filter the live feed →| First seen | Type | Indicator | Role | Where |
|---|---|---|---|---|
| 2026-10-11 16:10 | Domain | slotcatalog[.]co | Botnet C2 | — |
| 2026-10-11 15:59 | SHA256 | 82c614f3781d0706d862e0f9f0a51db025fecbcaeb74107d060f6c4a0f6ad24c | Malware sample | — |
| 2026-10-11 15:46 | SHA1 | a8773af716f8811e9e3e8482a9bb3d1905ba5928 | payload | — |
| 2026-10-11 15:46 | MD5 | 1843db1abb66e726e081329dd239d6e8 | payload | — |
| 2026-10-11 15:46 | SHA1 | c23a83c1459ed3bbbf81885dad9b0f249a30cf3e | payload | — |
| 2026-10-11 15:46 | MD5 | 675a6bcf1161098f7fc8e65cf6b07ec8 | payload | — |
| 2026-10-11 15:46 | SHA256 | 92a4bdc95e0d99200c7e703b2739ffdc1c0dd6b974bd4e97a375ad5a09b1e480 | payload | — |
| 2026-10-11 15:46 | SHA256 | af5b59d2c3af86ee2d97b9bb459dec7b83e5033cfc9b53fb319dbcdddb79e5d5 | payload | — |
| 2026-10-11 15:46 | SHA256 | 329706c148a26631625f413212a3a09a0c2fbdab23c6ab5f4ba671101a15ecde | payload | — |
| 2026-10-11 15:46 | SHA1 | 94acf9c68414284c62963411c73f64d2ae9de6be | payload | — |
| 2026-10-11 15:46 | MD5 | 6af89b4a89be1cf869a1d4c14674ee45 | payload | — |
| 2026-10-11 15:46 | MD5 | 47bec036fe26fe8d70dac48627ce1de3 | payload | — |
| 2026-10-11 15:46 | SHA256 | 0fdf8b638918ac7a04c36e6ea150548dcd245caa8674601c8a9d5905e77f9bc3 | payload | — |
| 2026-10-11 15:46 | SHA1 | 7232d18772529973ece8cb06c7e7ba0a9dd540fd | payload | — |
| 2026-10-11 14:53 | TLS cert | 650f90b14ecb5dc0160ea61d0620402c075c2f3d | Botnet C2 | — |
| 2026-10-11 14:53 | TLS cert | 64d01c8e86e0a3b51c270743879a1fe966af0db4 | Botnet C2 | — |
| 2026-10-11 14:51 | TLS cert | 0f0a58e91f1c0f21ec7934e2f5e6b54187ed54be | Botnet C2 | — |
| 2026-10-11 13:54 | SHA256 | 21c8757a6e486534dc64e388930325f75a94d496008cbefff4e14ce79216fed2 | Malware sample | — |
| 2026-10-11 09:20 | Domain | ajaib123[.]vip | Botnet C2 | — |
| 2026-10-11 09:12 | SHA256 | 0fdf8b638918ac7a04c36e6ea150548dcd245caa8674601c8a9d5905e77f9bc3 | Malware sample | — |
| 2026-10-11 08:05 | IP | 103.170.217[.]147:80 | Botnet C2 | — |
| 2026-10-11 05:40 | Domain | ufabet88[.]vip | Botnet C2 | — |
| 2026-10-11 05:32 | SHA256 | 329706c148a26631625f413212a3a09a0c2fbdab23c6ab5f4ba671101a15ecde | Malware sample | — |
| 2026-10-11 05:10 | Domain | uvach[.]in | Botnet C2 | — |
| 2026-10-11 05:02 | SHA256 | af5b59d2c3af86ee2d97b9bb459dec7b83e5033cfc9b53fb319dbcdddb79e5d5 | Malware sample | — |
| 2026-10-11 04:30 | Domain | ghyu[.]in | Botnet C2 | — |
| 2026-10-11 04:21 | SHA256 | 92a4bdc95e0d99200c7e703b2739ffdc1c0dd6b974bd4e97a375ad5a09b1e480 | Malware sample | — |
| 2026-10-10 21:08 | MD5 | a6a09b6e372bf40b716d2bf3237c2902 | payload | — |
| 2026-10-10 21:08 | MD5 | df6f9ce4475da25b324829509ef5c186 | payload | — |
| 2026-10-10 21:08 | SHA256 | 26acdf091d7a9bcf72b056561bc69221de623d43097499a777f59cab859b88a1 | payload | — |
| 2026-10-10 21:08 | SHA1 | 5d5c5f7e3be6c4e74de331adfdbb17a62ef2ab9a | payload | — |
| 2026-10-10 21:08 | SHA256 | d5102a93f27c365d5a1d57e82d0d4571d558ff846c50efd7896905fc736148ea | payload | — |
| 2026-10-10 21:08 | SHA1 | 906a01862b47d1cac17b33ffa9e4074375aeb902 | payload | — |
| 2026-10-10 13:19 | TLS cert | 9f71ec8a14e7a86f050b0484934ce8acc519fa91 | Botnet C2 | — |
| 2026-10-10 06:00 | SHA256 | d5102a93f27c365d5a1d57e82d0d4571d558ff846c50efd7896905fc736148ea | Malware sample | — |
| 2026-10-10 06:00 | IP | 91.193.43[.]38:4748 | Botnet C2 | — |
| 2026-10-10 04:25 | SHA256 | 26acdf091d7a9bcf72b056561bc69221de623d43097499a777f59cab859b88a1 | Malware sample | — |
| 2026-10-10 04:25 | IP | 86.163.111[.]183:4782 | Botnet C2 | — |
| 2026-10-09 04:17 | SHA256 | bb1997b21cebee431584b640357d1fc737374464063d8fb3d9ea74116916f295 | Malware sample | — |
| 2026-10-07 07:05 | IP | 192.162.199[.]218:2222 | Botnet C2 | — |
| 2026-10-06 19:05 | IP | 114.66.20[.]236:8008 | Botnet C2 | — |
| 2026-10-06 10:40 | IP | 31.59.39[.]40:4545 | Botnet C2 | — |
| 2026-10-05 14:29 | SHA256 | c734e31036a2ef2d09b93028828ab08c79afb47c06d125f16af87706e58f2609 | payload | — |
| 2026-10-05 14:29 | SHA1 | 5b95bcc4f60d8653f0374f607d7ce67b1b5a2817 | payload | — |
| 2026-10-05 14:29 | MD5 | 82a4bd3e8d17ab61c6fb376bdaa08edd | payload | — |
| 2026-10-05 14:29 | SHA256 | 16c90a2348c565940e936cbdb37014e539d0533acc47700c81c4f281a91f9535 | payload | — |
| 2026-10-05 14:29 | SHA1 | efbd76e4dbff0ad6829758fcafe26ce911722322 | payload | — |
| 2026-10-05 14:29 | MD5 | 36cf6285b152d569a123b34f6a08d892 | payload | — |
| 2026-10-04 07:22 | TLS cert | b292d5884328be709c0c79ffd7c82c3fe9846417 | Botnet C2 | — |
| 2026-10-04 07:21 | TLS cert | eabc77465bebeb1b8b4980dbaa185cfcf64b4f92 | Botnet C2 | — |
| 2026-10-01 06:11 | TLS cert | 4768d20d3072a30b168c650b11a9e4d3e1a0dc60 | Botnet C2 | — |
| 2026-09-29 08:13 | TLS cert | c234496c7b0abcd873bb6bb5a54288b6d340b6ff | Botnet C2 | — |
| 2026-09-26 08:23 | TLS cert | 7a215b5a8eaf9b132cf84f22d9ee2202c2a028bf | Botnet C2 | — |
| 2026-09-26 08:16 | TLS cert | 8410f92dc9367bda715790bb163d32111731527d | Botnet C2 | — |
| 2026-09-24 05:14 | TLS cert | 9c6bff6fdc543dd366ea35f536945acd7177853a | Botnet C2 | — |
| 2026-09-23 09:49 | TLS cert | 82ad60b5fe3e77f88effbb586db3795a41e5f60b | Botnet C2 | — |
| 2026-09-23 07:57 | TLS cert | b85ab05112c6848ccf2dd6889903e1268cdc6a75 | Botnet C2 | — |
| 2026-09-21 13:21 | TLS cert | 9b798f7d87edcf42680454660f593afd696ef8ca | Botnet C2 | — |
| 2026-09-15 15:48 | TLS cert | ba3714d484afb75fd03911c59aa096cee9595955 | Botnet C2 | — |
| 2026-09-12 11:00 | TLS cert | 8cffe4fa8f624cb4c15790c414e04acde61e3651 | Botnet C2 | — |
| 2026-09-06 07:26 | TLS cert | de0a287fb9997f0ffbd36df79b13cfda63f0bfcd | Botnet C2 | — |
| 2026-09-06 07:19 | TLS cert | 22d945ac6c7c00fb7bb5d0dc3618a82d46cfd1e2 | Botnet C2 | — |
| 2026-09-02 08:09 | TLS cert | 6c6027c8ff18b0f79bd3c40848c2b189a18b49ac | Botnet C2 | — |
| 2026-08-29 06:37 | TLS cert | a6e6aa58bac84e56b868f5f618ef227b75d7208e | Botnet C2 | — |
| 2026-08-28 07:54 | TLS cert | d123d7f43d63545c7a8f643acbe73e81f35c3f14 | Botnet C2 | — |
| 2026-08-13 16:38 | TLS cert | 9b4c3ff8dc5891693f443320e3c1167c7cebe2b7 | Botnet C2 | — |
| 2026-08-13 13:44 | TLS cert | 0f1b05653c3b3ab3bb4ecd772dd024668cbe8df1 | Botnet C2 | — |
| 2026-08-10 08:20 | TLS cert | b364395fee8c2e4c9eaf9a2531f6f7ac7bf8e4ae | Botnet C2 | — |
| 2026-08-06 14:20 | TLS cert | ece1b6bdc8e62d35188aab274bdb0be28d84c43f | Botnet C2 | — |
| 2026-08-04 06:23 | TLS cert | b14379b3743c37a26289499aca921c99998649f1 | Botnet C2 | — |
| 2026-07-13 10:07 | TLS cert | 4c67471be88dd63db2466621fe9e2a2d848f5b79 | Botnet C2 | — |
| 2026-07-09 06:15 | TLS cert | 9cc76149b07c25893611bc8339406a6312ab2053 | Botnet C2 | — |
| 2026-07-07 06:15 | TLS cert | 1b64957d1d878c0c0b0b346849db2e64d487aa17 | Botnet C2 | — |
| 2026-07-06 08:15 | TLS cert | 83ff65960d2df4b29e78d6fd0342dcd5f053eb13 | Botnet C2 | — |
| 2026-07-03 07:15 | TLS cert | ac563907d31a21443760cee92a98b50bba6152aa | Botnet C2 | — |
| 2026-06-17 08:12 | TLS cert | 27e3cb5b0043884c7ebc0691e2e73ef3b95339ac | Botnet C2 | — |
| 2026-06-06 07:02 | TLS cert | ae590545961e96de860ea7434c0e8c69b924de6f | Botnet C2 | — |
| 2026-06-04 18:12 | TLS cert | 28c3106cd1cec9a5dfec7f2ba3b0dd7e70784429 | Botnet C2 | — |
| 2026-06-04 07:58 | TLS cert | bf26c599e3f5ea932f7b8c592138d42d49837713 | Botnet C2 | — |
| 2026-06-04 07:55 | TLS cert | 5b27051d67aa2cce9314596003b68709a13fc003 | Botnet C2 | — |
| 2026-05-28 13:09 | TLS cert | 8e733b34e95a7b98ada40292b8d35e9040016e65 | Botnet C2 | — |
| 2026-05-28 07:48 | TLS cert | 9f0d33c1eaa7afd41009d0ec594c0a408d2df123 | Botnet C2 | — |
| 2026-05-21 09:08 | TLS cert | 493f6dbb48806992e524df2a3a0fa0348cef243b | Botnet C2 | — |
| 2026-05-08 08:49 | TLS cert | 8a9c74049483847464da1ca3cf6f1f44e17a5f0f | Botnet C2 | — |
| 2026-05-05 13:38 | TLS cert | c47bcbcbe0b1c474542c7fdc233ec68ffb4dcf14 | Botnet C2 | — |
| 2026-05-05 13:34 | TLS cert | a08099ae4318bfc81af69fd382081262cc4e9487 | Botnet C2 | — |
| 2026-04-20 06:30 | TLS cert | bb085af0610557f877683616d87b7345b59c4f54 | Botnet C2 | — |
| 2026-04-17 18:43 | TLS cert | f78be258c92a94888f2e283ddb807dcc22689c86 | Botnet C2 | — |
| 2026-04-16 05:36 | TLS cert | e0127cb029c9d3778d15d3948b41ecdc8b44fb03 | Botnet C2 | — |
| 2026-04-14 19:46 | TLS cert | 54cd35dc5d5f8e7068ccd2c1d24222187784f90a | Botnet C2 | — |
| 2026-04-14 06:02 | TLS cert | f91937b78dc36f7f7b9ff70f0f53afeefe7ad31d | Botnet C2 | — |
| 2026-04-12 14:48 | TLS cert | 0a5d3ca898ee51340f483aa8f40e06c43813376e | Botnet C2 | — |
| 2026-04-12 14:48 | TLS cert | 15027af927e6be2c77fa1083e2ba69ed7ef77ec1 | Botnet C2 | — |
| 2026-04-09 14:23 | TLS cert | ee4dd385bf849f7621deed67382e64c17b864e20 | Botnet C2 | — |
| 2026-04-09 08:19 | TLS cert | 3787ee8b1d038bf52620e33956b452f4aa38214f | Botnet C2 | — |
| 2026-04-09 05:43 | TLS cert | f4c8b11947963395a1a1624aa04e8a717693f297 | Botnet C2 | — |
| 2026-04-09 05:42 | TLS cert | da6a5ce53cf7938615910d7e9ffb8cf4ab474efd | Botnet C2 | — |
| 2026-04-08 15:16 | TLS cert | ac45fe719d822c245e21c7feb1589a058798ab36 | Botnet C2 | — |
| 2026-04-08 15:16 | TLS cert | dcc40fee2faa2a722cf639524a942a8cdfcdcf84 | Botnet C2 | — |
| 2026-04-08 15:05 | TLS cert | 3873395f0d38d252571338283d55d332d853286d | Botnet C2 | — |
Defanged for safety. URL query strings removed.