Quasar
129 addresses convicted as Quasar remote-access trojan controllers — 129 still listed, 0 archived. Observed from 2026-08-23.
Detection packs
Rules for the 129 still-listed addresses on this page, regenerated as the archive updates; archived episodes are omitted, and a rule can lag a withdrawal by up to five minutes. Suricata rules are rev:2 — alert tcp on address and port, alert tls where a full certificate fingerprint is published — and carry the archive's own episode ids as sids, so packs load beside each other and beside any per-host file. YARA packs are hash matches only: this site holds no file bytes.
About
An open-source .NET remote-access tool, originally released as a legitimate remote administration utility and adopted almost immediately for intrusions. Its source availability means forks are common and version fingerprinting is unreliable. These certificates carry the structural marker the whole lineage shares AND still name Quasar in the subject — the narrower and stronger of the two signals, identifying the product rather than only the codebase. Where the default name did not survive, the structure is all that remains and the listener is recorded at /c2/quasar-family instead. A label describes a LISTENER, not an address, so a machine running more than one — or re-detected later with a regenerated certificate — can appear on both. Re-labelled by the upstream in place: 22 hosts earlier labelled Quasar-family; 5 hosts earlier labelled AsyncRAT. The archive keeps only the most recent earlier label per episode. Recently first observed in AS8987 on 2026-09-14 (1 host); AS139341 on 2026-09-14 (1 host); AS55933 on 2026-09-12 (1 host); AS17222 on 2026-09-12 (1 host); AS13009 on 2026-09-12 (1 host); AS33993 on 2026-09-12 (1 host) — networks this family had not appeared in before, as seen by this archive.
Ports
Addresses · page 2 of 2
Ordered by when this archive first recorded them, newest first — a stable ordering, so a page holds the same addresses tomorrow. Archived addresses are included and marked; they are the majority of this corpus over time.
Listed in error?
These pages are generated from automated scanning and are publicly available. Write to support@publicmosaic.com — see abuse & takedown, or opt-out to exclude a network range from scanning.