AsyncRAT
172 hosts convicted as AsyncRAT remote-access trojan controllers: 172 still listed, 0 archived. First seen 2026-08-23.
About
AsyncRAT is an open-source .NET remote-access trojan published by NYAN-x-CAT on GitHub in 2019, popular with criminals and the ancestor of DcRat and VenomRAT. ESET and Censys call it a rewrite of Quasar, not a fork, yet it copied Quasar's then-unreleased certificate routine line for line, so its default certificate, named AsyncRAT Server, shares a JA4X with Quasar's. The scanner identifies it from its certificate, its protocol replies, or an AsyncRAT sample it analysed. A listed address is the controller its implants are built to report to, or a server seen distributing them, never a machine running an implant. The server defaults to ports 6606, 7707 and 8808, though many addresses here were seen on others. The certificate is made once and embedded in every implant, so addresses sharing one trace to one certificate file, not necessarily one operator; a listing cannot say who runs them or why.
Ports
The 8 ports with the most hosts, of 229.
Observed changes
Relabelled: 74 hosts earlier labelled Quasar-family; 5 hosts earlier labelled Quasar. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS140810 on 2026-10-27 (1 host).
Detection packs
Rules for this hub's 172 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 1 of 2
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.