VenomRAT
2 hosts convicted as VenomRAT remote-access trojan controllers: 2 still listed, 0 archived. First seen 2026-09-01.
About
A commercial fork of AsyncRAT — sold as a product, unlike the open-source DcRat — that shares its lineage's wire protocol and builder certificate template. A listener is listed under this name only where a recovered sample configuration proved the fork; where only the network was observed it sits under DcRat or VenomRAT instead, because from outside the two cannot be told apart.
Ports
Observed changes
Relabelled: 1 host earlier labelled DcRat or VenomRAT; 1 host earlier labelled AsyncRAT. Only the most recent earlier label is kept.
Detection packs
Rules for this hub's 2 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Files
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.