Content available in original language
class="post-article">
Infostealer C#/.NET Active since 2025

QuasarStealer

QuasarRAT tabanli credential stealer modulu. Chrome/Edge/Brave icin ChromiumDecryptor+DecryptAesGcm, Firefox icin FFDecryptor+PK11SDR_Decrypt, Yandex icin YandexPassReader kullanir. FileZilla ve WinSCP FTP istemci sifreleri de celir. PE timestamp gelecek tarihli (anti-sandbox teknik). QuasarRAT acik kaynak istemcisinden tureyiyor.

Threat Profile
Type Infostealer
Programming LanguageC#/.NET
C2 ProtocolHTTP
First Seen2025
Targets Kuresel
Purpose / Capabilities
  • Credential Theft/FTP
No C2 servers have been identified for this family yet.

Research Reports (1)

Yüksek

QuasarStealer 2e6fbd14 -- QuasarRAT ChromePassReader EdgePassReader BravePassReader FirefoxPK11SDR YandexPassReader FileZilla WinSCP ChromiumDecryptor DecryptAesGcm | Yuksek

QuasarStealer 2e6fbd14 PE32 59KB. Quasar.Client.Recovery.FtpClients. Chrome/Edge/Brave/Firefox/Yandex sifre hırsızı. FileZilla+WinSCP FTP. DecryptAesGcm+PK11SDR_Decrypt.

Read Report →