xRAT (QuasarRAT) Malware Being Distributed Through Adult Game Webhard

AhnLab ASEC discovered xRAT (QuasarRAT) being distributed through Korean webhard sites disguised as an adult game; the installer drops a launcher and Pak files that place Play.exe, GoogleUpdate.exe, and WinUpdate.db into user AppData, where GoogleUpdate.exe AES-decrypts shellcode from WinUpdate.db, injects xRAT into explorer.exe, and patches EtwEventWrite to disable ETW logging. The RAT performs system information collection, keylogging, and file transfer. The report includes MD5 IOCs and detections and warns users to avoid downloading executables from file-sharing sites and to obtain software from official sources.