QuasarRAT
Named by 2 kept items in this workspace.
Search every workspace for QuasarRAT. It matches the name as written, so it can find other things that share it.
The items that name it 2
Payload disguised as 'svchosts.exe' deployed by UAT-10147
Remote Access Trojan seen periodically in the author's IR cases; used against NATO facilities in March 2023 per Proofpoint report; described in detail in Qualys paper 'Stealthy Quasar Evolving to Lead the RAT Race'.
All threat actors in this workspace.