QuasarRAT tabanli credential stealer modulu. Chrome/Edge/Brave icin ChromiumDecryptor+DecryptAesGcm, Firefox icin FFDecryptor+PK11SDR_Decrypt, Yandex icin YandexPassReader kullanir. FileZilla ve WinSCP FTP istemci sifreleri de celir. PE timestamp gelecek tarihli (anti-sandbox teknik). QuasarRAT acik kaynak istemcisinden tureyiyor.
QuasarStealer 2e6fbd14 PE32 59KB. Quasar.Client.Recovery.FtpClients. Chrome/Edge/Brave/Firefox/Yandex sifre hırsızı. FileZilla+WinSCP FTP. DecryptAesGcm+PK11SDR_Decrypt.
レポートを読む →