AsyncRAT
97 addresses convicted as AsyncRAT remote-access trojan controllers — 97 still listed, 0 archived. Observed from 2026-08-23.
Detection packs
Rules for the 97 still-listed addresses on this page, regenerated as the archive updates; archived episodes are omitted, and a rule can lag a withdrawal by up to five minutes. Suricata rules are rev:2 — alert tcp on address and port, alert tls where a full certificate fingerprint is published — and carry the archive's own episode ids as sids, so packs load beside each other and beside any per-host file. YARA packs are hash matches only: this site holds no file bytes.
About
An open-source .NET remote-access trojan with a large fork ecosystem — DcRat and several others derive from it — and it derives in turn from Quasar, so Quasar, AsyncRAT and DcRat are one descent chain rather than three neighbours. Its builder defaults to ports 6606, 7707 and 8808, so a host on one of those is a strong indicator, though most listed here are not. The certificate TEMPLATE follows that descent: the same distinguished-name shape, and so the same JA4X, runs the length of the chain. The certificate itself is still generated per server, so a shared JA4X places a host in the lineage while a shared SHA-256 is the far stronger claim of a shared build or operator. Re-labelled by the upstream in place: 68 hosts earlier labelled Quasar-family. The archive keeps only the most recent earlier label per episode. Recently first observed in AS51167 on 2026-09-10 (2 hosts); AS397423 on 2026-09-10 (1 host); AS210558 on 2026-09-09 (1 host); AS7552 on 2026-09-09 (1 host); AS12578 on 2026-09-08 (1 host); AS50010 on 2026-09-08 (1 host) — networks this family had not appeared in before, as seen by this archive. Upstream population estimate: hosts of this family observed moving toward AS7552 on 2026-09-03 (fewer than 10 hosts) — the upstream scanner's estimate from a passive search population, not this archive's observation, and shown only for networks where this archive holds at least one host of this family.
Ports
Addresses
Ordered by when this archive first recorded them, newest first — a stable ordering, so a page holds the same addresses tomorrow. Archived addresses are included and marked; they are the majority of this corpus over time.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.