DcRat
123 hosts convicted as DcRat remote-access trojan controllers: 123 still listed, 0 archived. First seen 2026-08-28.
About
An open-source Windows remote-access trojan built on AsyncRAT's code, published on GitHub by the developer qwqdanchun in March 2021 under the MIT licence; its functions include remote desktop, keylogging and stealing saved passwords. Its author stopped updating it in early 2022, citing its abuse, and the repository is archived. A listed address is the controller its implants connect back to, or a server that delivered a build, never an infected machine. Its default port is 8848, where this hub's addresses were most often observed. A recorded certificate is typically the one its builds have generated since late March 2021: the subject names the product and, whoever deploys it, the issuer carries the author's handle. The host pages call it issuer- signed because those names differ, though it is signed with its own key. Dumplings RAT, a rebuild that renamed the product but kept the handle, is listed here too. A listing says nothing about who runs the server or why.
Ports
The 8 ports with the most hosts, of 64.
Observed changes
Relabelled: 21 hosts earlier labelled Quasar-family; 4 hosts earlier labelled VenomRAT. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS20473 on 2026-10-27 (2 hosts); AS397373 on 2026-10-26 (1 host); AS150895 on 2026-10-26 (1 host); AS58519 on 2026-10-26 (1 host).
Detection packs
Rules for this hub's 123 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 2 of 2
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.