DcRat
71 addresses convicted as DcRat remote-access trojan controllers — 71 still listed, 0 archived. Observed from 2026-08-28.
Detection packs
Rules for the 71 still-listed addresses on this page, regenerated as the archive updates; archived episodes are omitted, and a rule can lag a withdrawal by up to five minutes. Suricata rules are rev:2 — alert tcp on address and port, alert tls where a full certificate fingerprint is published — and carry the archive's own episode ids as sids, so packs load beside each other and beside any per-host file. YARA packs are hash matches only: this site holds no file bytes.
About
An open-source .NET remote-access trojan forked from AsyncRAT, published on GitHub in 2021 and archived by its author the following year after it was widely abused. Do not confuse it with DarkCrystal RAT, a separate program sold on criminal forums that vendor reporting often files under the same name; the addresses listed here were overwhelmingly observed on 8848, which is this fork's default and not DarkCrystal's. It inherits AsyncRAT's certificate shape, so the two collide on JA4X even though each server generates its own certificate. Not all of those certificates are self-signed in the usual sense: some are issued by a SECOND certificate rather than by themselves — a two-tier arrangement that still chains to nothing, and one a check keyed on self-signed alone would miss entirely. Re-labelled by the upstream in place: 5 hosts earlier labelled VenomRAT. The archive keeps only the most recent earlier label per episode. Recently first observed in AS4907 on 2026-09-11 (1 host); AS42708 on 2026-09-10 (1 host); AS47890 on 2026-09-08 (1 host); AS215428 on 2026-09-08 (1 host); AS27831 on 2026-09-08 (1 host) — networks this family had not appeared in before, as seen by this archive.
Ports
Addresses
Ordered by when this archive first recorded them, newest first — a stable ordering, so a page holds the same addresses tomorrow. Archived addresses are included and marked; they are the majority of this corpus over time.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.