Qealler

Internal ID: jar.qealler

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying jar.qealler. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

Qealler is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://github.com/jeFF0Falltrades/Malware-Writeups/blob/master/Qealler/Qealler-Unloaded.pdf

→https://www.cyberark.com/threat-research-blog/qealler-the-silent-java-credential-thief/

→https://www.herbiez.com/?p=1352

→https://www.securityinbits.com/malware-analysis/pyrogenic-infostealer-static-analysis-part-0x1/

→https://www.securityinbits.com/malware-analysis/similarity-between-qealler-pyrogenic-variants-part-0x3/

→https://www.securityinbits.com/malware-analysis/unpacking/unpacking-pyrogenic-qealler-using-java-agent-part-0x2/

→https://www.zscaler.com/blogs/research/qealler-new-jar-based-information-stealer

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

jar.qealler

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Qealler