HPlus HTS config.Ini FTP-Sourced Quasar RAT Installation

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•0

Detects the historical HPlus HTS fraud infrastructure chain. The rule monitors for the reading of a configuration file named 'config.Ini', followed by an outbound FTP connection (port 21), and the subsequent launch of an executable, which is indicative of a Quasar RAT deployment sequence.