BlotchyQuasar RAT Mutex Detection

Achmad Adhikara@adhikara13

•updated Feb 27, 2026•0•12

This rule detects the creation of specific mutexes known to be associated with the BlotchyQuasar Remote Access Trojan (RAT). The rule specifically looks for the mutex name '44474877AKs8XXT4SylAo2kAlUS2kYkala!'. Detection of this mutex indicates potential BlotchyQuasar RAT activity on a Windows system.