Quasar-family
58 hosts convicted as Quasar-family remote-access trojan controllers: 58 still listed, 0 archived. First seen 2026-08-23.
About
Quasar, an open-source C# remote-access tool published by the developer MaxXor as remote- administration software, began the line of remote-access trojans this label names, among them AsyncRAT, its fork DcRat, and VenomRAT, advertised on malware forums from 2020. Quasar's certificate code, public since 2018 and copied into AsyncRAT and DcRat, writes the same two extensions whatever name it is given, so their certificates share the last part of a JA4X. A listener is listed here when its certificate or its protocol replies show this shared code. Where the scanner holds a certificate name, protocol reply or sample configuration tied to one program, it usually lists the listener under that program instead, and may move it here on withdrawing that evidence. A listing identifies a server, never a machine running a client; it cannot say which program the server runs or who operates it.
Ports
The 8 ports with the most hosts, of 22.
Observed changes
Relabelled: 27 hosts earlier labelled Quasar; 8 hosts earlier labelled PureRAT; 2 hosts earlier labelled VenomRAT; 2 hosts earlier labelled DcRat or VenomRAT; 2 hosts earlier labelled DcRat. Only the most recent earlier label is kept.
Detection packs
Rules for this hub's 58 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Files
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.