s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013275 high

📛 Threat Title

AsyncRAT: SHA1 hash of a malware sample (payload) 2a96f2221fce85746ece71c98de5251cedb1bf36

Category: AsyncRAT Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: AsyncRAT. Confidence: 95. First seen: 2026-11-03 16:42:27 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 2a96f2221fce85746ece71c98de5251cedb1bf36 VT 60 / 75

IOC database

Type
hash_sha1
Value
2a96f2221fce85746ece71c98de5251cedb1bf36
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Malware/Win32.RL_Generic.C3558490
Alibaba malicious Backdoor:MSIL/AsyncRat.64fb1d6e
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Generic.AsyncRAT.Marte.B.68BFDB32
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.68BFDB32
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/Dropper.Gen
BitDefender malicious Generic.AsyncRAT.Marte.B.68BFDB32
Bkav malicious W32.Malware.D1B821A9
CAT-QuickHeal malicious Trojan.IgenericFC.S14890850
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.unknown.asyncrat
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.AsyncRAT.115
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Trojan.Agent (A)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/Dropper.Gen
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Agent.sa
huorong malicious Backdoor/MSIL.DcRat.a
Ikarus malicious Trojan.MSIL.AsyncRAT
Jiangmin malicious Backdoor.MSIL.gguk
K7AntiVirus malicious Trojan ( 005c228f1 )
K7GW malicious Trojan ( 005c228f1 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
McAfeeD malicious Trojan:Win/Generic.BCX
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.68BFDB32
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhhviy
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!1D1934C74BBA
Sophos malicious Troj/AsyncRat-B
SUPERAntiSpyware malicious Trojan.Agent/Gen-Kryptik
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious suspicious.low.ml.score
TrellixENS malicious Fareit-FZT!1D1934C74BBA
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.SMXSR
TrendMicro-HouseCall malicious Backdoor.MSIL.ASYNCRAT.SMXSR
Varist malicious W32/Samas.B.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Generic.AsyncRAT.Marte.B.68BFDB32
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.46080.RUL
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD51d1934c74bbafed34ff53e4511a308b5
SHA-12a96f2221fce85746ece71c98de5251cedb1bf36
SHA-256f5ee612748cedfd68340a5394f65072aa052d02820e5e8db5587ac36e53046be
VHash244036555511d08d2e1d104c
SSDEEP768:xuQSNTvEEaBrWUXFd5mo2qmiWv8n2+Fjw2NLPIPzjbfgXIiE3b8FWC0BDZex:xuQSNT8572xzv9Ew2CP3boXFE3bqCdex
TLSHT171231B003BE8812BF2BE4F7499F26145467AF2677603D64D2CC452DB5713FC69A02AEE
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size45.0 KB
History
Creation date2023-10-16 21:40 UTC
First seen on VirusTotal2026-11-02 06:27 UTC
Last submission2026-11-03 21:56 UTC
Last analysis2026-11-03 21:56 UTC
Last modified on VirusTotal2026-11-04 00:01 UTC
Known Names
  • Stub.exe
  • GoogleUpdate.exe
  • f5ee612748cedfd68340a5394f65072aa052d02820e5e8db5587ac36e53046be.exe
  • 4sesjdc.exe
  • k7takwv1.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: AsyncRAT. Confidence: 95. First seen: 2026-11-03 16:42:27 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | AsyncRAT - abuse.ch
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as AsyncRAT .

  • MalwareBazaar | AsyncRAT - abuse.ch
    web:bazaar.abuse.ch

    Malware samples associated with tag AsyncRAT MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with AsyncRAT . Database Entry

  • ASyncRAT Analysis and Decryption | xephora/Threat-Remediation-Scripts ...
    web:deepwiki.com

    Purpose and Scope This document covers the analysis of ASyncRAT (Asynchronous Remote Access Tool) campaigns and the methodology for decrypting stage 2 payloads . It provides indicators of compromise (IOCs) from multiple observed campaigns and technical details for payload extraction and decryption. For broader backdoor and RAT analysis, see Backdoors and Remote Access Tools. For other malware ...

  • malwarecenter/2026/AsyncRat at main · N-Yakimov/malwarecenter
    web:github.com

    AsyncRAT Malware analysis Recently, I came across an interesting sample of AsyncRAT . It stands out by the fact that it has a built in custom encryption to encrypt the strings it is using. I personally haven't seen that in this strain of malware before so I decided to look into it and write a nice breakdown of how the encryption works, reconstruct it in a nice Python based decryption tool ...

  • oheskia/AsyncRAT-Incident-Analysis - GitHub
    web:github.com

    C2 Identification: Discovered command-and-control communication occurring on a non-standard port (TCP/222). Threat Intelligence: Correlated SHA256 hashes with VirusTotal to confirm the AsyncRAT malware family. Documentation: Produced a comprehensive 15-page incident report tailored for both technical and executive audiences.

  • AsyncRAT Uses AutoIt in a Five-Stage Infection Chain
    web:socprime.com

    Summary A five-stage AsyncRAT infection chain has been identified that uses a socially engineered batch file and the legitimate AutoIt interpreter for execution. The malware relies on layered obfuscation, including Base64 fragment reconstruction and multiple rounds of XOR decryption, to evade detection. The final stage deploys a .NET-based AsyncRAT payload that is injected into a legitimate ...

  • Threat Actors Weaponize AI Hype to Deliver AsyncRAT
    web:www.fortinet.com

    FortiGuard Labs analyzes a multi-stage malware campaign that uses fake AI-themed documents, hidden PowerShell scripts, AutoHotkey loaders, and process injection to deploy AsyncRAT and maintain remote access.

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    Technical analysis of AsyncRAT malware AsyncRAT operates by embedding itself into victim systems via malicious downloads or email attachments. Once executed, it establishes communication with a command-and-control (C2) server to download additional payloads , execute commands, and exfiltrate data.

  • AsyncRAT Loader: Advanced Threat Analysis - levelblue.com
    web:www.levelblue.com

    The AsyncRAT loader uses multi-stage obfuscation and anti-sandboxing routines to evade automatic detection during payload delivery. Phishing webpages deliver JavaScript files that decrypt C2 URLs by subtracting constant values from arrays of decimal numbers to obtain ASCII characters. LevelBlue research reveals that C2 servers deliver HTTP scripts containing Base64 code, XOR encryption, and ...

  • Trojan:BAT/AsyncRat threat description - microsoft.com
    web:www.microsoft.com

    Trojan:BAT/ AsyncRat (Asynchronous Remote Access Trojan) is a sophisticated, feature-rich malware that provides threat actors with full remote control over compromised Windows devices. First published as open-source software on GitHub in 2019, its code has been weaponized and modified by a diverse range of threat actors. This open-source nature has made AsyncRAT a cornerstone of modern malware ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.