PureRAT
290 hosts convicted as PureRAT remote-access trojan controllers: 290 still listed, 0 archived. First seen 2026-08-23.
About
PureRAT is a .NET remote-access trojan — hidden-desktop control, keylogging, webcam and microphone capture — sold rather than published by the developer known as PureCoder, whose Telegram channels also sell the PureCrypter loader and the PureLogs stealer. It succeeded the same developer's PureHVNC, and Netresec identified it as the malware Morphisec reported as ResolverRAT. What is listed here is the operator's side of the software — the controller or a service running on it — never an infected machine. Most of these servers presented one of two kinds of self-signed certificate: one named "PureRAT Agent", found mostly on 56001-56003, the default ports public reporting gives; the other naming api.purecoder.io, usually on 443. A given certificate is seldom shared between servers. A self-signed certificate can claim any name, so that domain says nothing about who operated a server — and a listing records the software, never who ran it.
Ports
The 8 ports with the most hosts, of 41.
Observed changes
Relabelled: 3 hosts earlier labelled Quasar; 1 host earlier labelled Quasar-family; 1 host earlier labelled Overlord. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS18186 on 2026-10-30 (2 hosts); AS140869 on 2026-10-29 (1 host); AS398019 on 2026-10-25 (1 host); AS36884 on 2026-10-25 (2 hosts); AS33363 on 2026-10-24 (1 host).
Detection packs
Rules for this hub's 290 still-listed hosts, across all 3 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Files
Hosts · page 1 of 3
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.