Quasar
284 hosts convicted as Quasar remote-access trojan controllers: 128 still listed, 156 archived. First seen 2026-08-23.
About
Quasar is an open-source remote-access tool for Windows, written in C# and published as remote- administration software by the developer MaxXor: first on GitHub as xRAT in 2014, renamed in 2015. Palo Alto Networks' Unit 42 observed it in attacks on governments in 2016, and MITRE ATT&CK lists state-linked espionage groups among its users. Its server is the operator's console, listening by default on port 4782, and the clients its builder produces connect back to it. Since version 1.4 (2020) they do so over TLS: on first run the operator creates or imports a certificate; the one created is self-signed, RSA-4096, valid until the year 9999 and named Quasar Server CA. Each client carries a copy to check the server against. That certificate identifies the server's listener, never a machine running a client; a modified build may be listed as Quasar-family instead. A listing says nothing about who runs it or why.
Ports
The 8 ports with the most hosts, of 88.
Observed changes
Relabelled: 5 hosts earlier labelled Quasar-family. Only the most recent earlier label is kept.
New networks for this family in this archive, last 7 days: AS209 on 2026-10-26 (1 host); AS52368 on 2026-10-26 (1 host).
Detection packs
Rules for this hub's 128 still-listed hosts, across all 3 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 1 of 3
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.