[GH-ISSUE #389] Builder: attempt to bind the client to a common windows process #186

New issue

Closed

opened 2026-02-27 15:49:15 +03:00 by kerem · 4 comments

kerem commented

2026-02-27 15:49:15 +03:00

Owner

Originally created by @webiummedia on GitHub (Sep 9, 2015).
Original GitHub issue: https://github.com/quasar/Quasar/issues/389

I seen this in an other rat. In the builder you could tick a box where on installation the client would try to bind itself to an existing windows process so it can't be killed by the user or makes it look legit when the task manager is checked.

Originally created by @webiummedia on GitHub (Sep 9, 2015). Original GitHub issue: https://github.com/quasar/Quasar/issues/389 I seen this in an other rat. In the builder you could tick a box where on installation the client would try to bind itself to an existing windows process so it can't be killed by the user or makes it look legit when the task manager is checked.

kerem

2026-02-27 15:49:15 +03:00

closed this issue
added the
wont-add
label

kerem commented

2026-02-27 15:49:15 +03:00

Author

Owner

@yankejustin commented on GitHub (Sep 9, 2015):

I don't like this idea. This is almost entirely for malicious purposes which we are moving away from.

@yankejustin commented on GitHub (Sep 9, 2015): I don't like this idea. This is almost entirely for malicious purposes which we are moving away from.

kerem commented

2026-02-27 15:49:15 +03:00

Author

Owner

@webiummedia commented on GitHub (Sep 10, 2015):

Actually this can be useful when an employee is under investigation by the administration like I am doing now.

@webiummedia commented on GitHub (Sep 10, 2015): Actually this can be useful when an employee is under investigation by the administration like I am doing now.

kerem commented

2026-02-27 15:49:15 +03:00

Author

Owner

@yankejustin commented on GitHub (Sep 10, 2015):

I see your use of it but this really hits the realm of process injection at an angle that couldn't make it easier to exploit. 🎩

@yankejustin commented on GitHub (Sep 10, 2015): I see your use of it but this really hits the realm of process injection at an angle that couldn't make it easier to exploit. :tophat:

kerem commented

2026-02-27 15:49:15 +03:00

Author

Owner

@MaxXor commented on GitHub (Sep 10, 2015):

No.

@MaxXor commented on GitHub (Sep 10, 2015): No.

kerem referenced this issue

2026-02-27 15:52:51 +03:00

[PR #186] [MERGED] Keylogger fixes #1033