xRAT Malware Attacking Windows Users Disguised as Adult Game

Ahnlab/ASEC researchers identified a coordinated campaign in Korea distributing xRAT/QuasarRAT disguised as fake games on popular webhard file‑sharing sites; the malware installs via a ZIP containing Game.exe and Data*.Pak files, drops components (Play.exe, GoogleUpdate.exe, WinUpdate.db), decrypts and injects shellcode into explorer.exe, patches EtwEventWrite to disable Windows event logging, and performs system reconnaissance, keylogging, and unauthorized file transfers.