s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419 high

📛 Threat Title

AsyncRAT: 0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 803336 bytes. Tags: AsyncRAT, exe. Reporter: adrian__luca. First seen: 2026-05-08 12:43:27.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
656 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419 VT 55 / 75

IOC database

Type
hash_sha256
Value
0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 55 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Malware/Win.Cryp.C5867594
Alibaba malicious Backdoor:MSIL/Formbook.c6cab18b
alibabacloud malicious Backdoor:MSIL/Formbook.AK!M3DGW
ALYac malicious Trojan.GenericKD.79882602
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWorm
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C2E96A
Avast malicious Win32:MalwareX-gen [Cryp]
AVG malicious Win32:MalwareX-gen [Cryp]
Avira malicious TR/W32.MalwareX
BitDefender malicious Trojan.GenericKD.79882602
Bkav malicious W32.Malware.4D801D8B
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Inject6.34760
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.GenericKD.79882602 (B)
ESET-NOD32 malicious MSIL/Kryptik.APZM trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/Formbook.GWMJE!tr
GData malicious Trojan.GenericKD.79882602
Google malicious Detected
Ikarus malicious Trojan.MSIL.Inject
K7AntiVirus malicious Riskware ( 00584baa1 )
K7GW malicious Riskware ( 00584baa1 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.Formbook.m!c
Malwarebytes malicious Trojan.MalPack
MaxSecure malicious Trojan.Malware.273046945.susgen
McAfeeD malicious Trojan:Win/GenericPack.BMP
Microsoft malicious Trojan:MSIL/Formbook.ABFL!MTB
MicroWorld-eScan malicious Trojan.GenericKD.79882602
NANO-Antivirus malicious Trojan.Win32.Inject6.lhiupe
Paloalto malicious generic.ml
Panda malicious Trj/Agent.AY
Rising malicious Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:K69CPpPjZw/5XFbJuznSAw)
Sangfor malicious Backdoor.Msil.Formbook.Vy5a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Artemis!Trojan
Sophos malicious Troj/Krypt-AWL
Symantec malicious Scr.Malcode!gdn34
Tencent malicious OB:Trojan.Win64.Inoci.16003941
TrellixENS malicious Artemis!A2EC80BD4DA1
TrendMicro malicious Backdoor.MSIL.FORMBOOK.TL0101E826ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Agent.ISV.gen!Eldorado
VBA32 malicious TScope.Trojan.MSIL
VIPRE malicious Trojan.GenericKD.79882602
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Agent.803336.A
Webroot malicious Win.Trojan.Gen
ZoneAlarm malicious Troj/Krypt-AWL

Details From VirusTotal

Basic Properties
MD5a2ec80bd4da144b4ba8a3ab9406483e4
SHA-1deac0e5592c710df4c8d813ca4c42e0227da5a9c
SHA-2560a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419
VHash285036755511c08237413021f
SSDEEP24576:HM8+v9OiUr6SpkXcFCINpBlKmGXU5DbNOf:av3UrhpkMo8flKDkQ
TLSHT12A0501B4AA2DCA02D8A543F80A61E73413F0AC9DF120D24B9EFDFCEB78B57552419647
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size784.5 KB
History
Creation date2069-03-24 03:39 UTC
First seen on VirusTotal2026-04-08 07:28 UTC
Last submission2026-05-08 12:51 UTC
Last analysis2026-05-25 06:31 UTC
Last modified on VirusTotal2026-06-05 17:58 UTC
Known Names
  • 0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419.exe
  • yvghxg.exe
  • _0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419.exe
  • Yeni_talep-pdf.bat
hash_sha1 deac0e5592c710df4c8d813ca4c42e0227da5a9c VT 55 / 75

IOC database

Type
hash_sha1
Value
deac0e5592c710df4c8d813ca4c42e0227da5a9c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 55 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Malware/Win.Cryp.C5867594
Alibaba malicious Backdoor:MSIL/Formbook.c6cab18b
alibabacloud malicious Backdoor:MSIL/Formbook.AK!M3DGW
ALYac malicious Trojan.GenericKD.79882602
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWorm
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C2E96A
Avast malicious Win32:MalwareX-gen [Cryp]
AVG malicious Win32:MalwareX-gen [Cryp]
Avira malicious TR/W32.MalwareX
BitDefender malicious Trojan.GenericKD.79882602
Bkav malicious W32.Malware.4D801D8B
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Inject6.34760
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.GenericKD.79882602 (B)
ESET-NOD32 malicious MSIL/Kryptik.APZM trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/Formbook.GWMJE!tr
GData malicious Trojan.GenericKD.79882602
Google malicious Detected
Ikarus malicious Trojan.MSIL.Inject
K7AntiVirus malicious Riskware ( 00584baa1 )
K7GW malicious Riskware ( 00584baa1 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.Formbook.m!c
Malwarebytes malicious Trojan.MalPack
MaxSecure malicious Trojan.Malware.273046945.susgen
McAfeeD malicious Trojan:Win/GenericPack.BMP
Microsoft malicious Trojan:MSIL/Formbook.ABFL!MTB
MicroWorld-eScan malicious Trojan.GenericKD.79882602
NANO-Antivirus malicious Trojan.Win32.Inject6.lhiupe
Paloalto malicious generic.ml
Panda malicious Trj/Agent.AY
Rising malicious Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:K69CPpPjZw/5XFbJuznSAw)
Sangfor malicious Backdoor.Msil.Formbook.Vy5a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Artemis!Trojan
Sophos malicious Troj/Krypt-AWL
Symantec malicious Scr.Malcode!gdn34
Tencent malicious OB:Trojan.Win64.Inoci.16003941
TrellixENS malicious Artemis!A2EC80BD4DA1
TrendMicro malicious Backdoor.MSIL.FORMBOOK.TL0101E826ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Agent.ISV.gen!Eldorado
VBA32 malicious TScope.Trojan.MSIL
VIPRE malicious Trojan.GenericKD.79882602
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Agent.803336.A
Webroot malicious Win.Trojan.Gen
ZoneAlarm malicious Troj/Krypt-AWL

Details From VirusTotal

Basic Properties
MD5a2ec80bd4da144b4ba8a3ab9406483e4
SHA-1deac0e5592c710df4c8d813ca4c42e0227da5a9c
SHA-2560a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419
VHash285036755511c08237413021f
SSDEEP24576:HM8+v9OiUr6SpkXcFCINpBlKmGXU5DbNOf:av3UrhpkMo8flKDkQ
TLSHT12A0501B4AA2DCA02D8A543F80A61E73413F0AC9DF120D24B9EFDFCEB78B57552419647
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size784.5 KB
History
Creation date2069-03-24 03:39 UTC
First seen on VirusTotal2026-04-08 07:28 UTC
Last submission2026-05-08 12:51 UTC
Last analysis2026-05-25 06:31 UTC
Last modified on VirusTotal2026-06-05 17:58 UTC
Known Names
  • 0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419.exe
  • yvghxg.exe
  • _0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419.exe
  • Yeni_talep-pdf.bat
hash_md5 a2ec80bd4da144b4ba8a3ab9406483e4 VT 55 / 75

IOC database

Type
hash_md5
Value
a2ec80bd4da144b4ba8a3ab9406483e4
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 55 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Malware/Win.Cryp.C5867594
Alibaba malicious Backdoor:MSIL/Formbook.c6cab18b
alibabacloud malicious Backdoor:MSIL/Formbook.AK!M3DGW
ALYac malicious Trojan.GenericKD.79882602
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWorm
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C2E96A
Avast malicious Win32:MalwareX-gen [Cryp]
AVG malicious Win32:MalwareX-gen [Cryp]
Avira malicious TR/W32.MalwareX
BitDefender malicious Trojan.GenericKD.79882602
Bkav malicious W32.Malware.4D801D8B
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Inject6.34760
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.GenericKD.79882602 (B)
ESET-NOD32 malicious MSIL/Kryptik.APZM trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/Formbook.GWMJE!tr
GData malicious Trojan.GenericKD.79882602
Google malicious Detected
Ikarus malicious Trojan.MSIL.Inject
K7AntiVirus malicious Riskware ( 00584baa1 )
K7GW malicious Riskware ( 00584baa1 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.Formbook.m!c
Malwarebytes malicious Trojan.MalPack
MaxSecure malicious Trojan.Malware.273046945.susgen
McAfeeD malicious Trojan:Win/GenericPack.BMP
Microsoft malicious Trojan:MSIL/Formbook.ABFL!MTB
MicroWorld-eScan malicious Trojan.GenericKD.79882602
NANO-Antivirus malicious Trojan.Win32.Inject6.lhiupe
Paloalto malicious generic.ml
Panda malicious Trj/Agent.AY
Rising malicious Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:K69CPpPjZw/5XFbJuznSAw)
Sangfor malicious Backdoor.Msil.Formbook.Vy5a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Artemis!Trojan
Sophos malicious Troj/Krypt-AWL
Symantec malicious Scr.Malcode!gdn34
Tencent malicious OB:Trojan.Win64.Inoci.16003941
TrellixENS malicious Artemis!A2EC80BD4DA1
TrendMicro malicious Backdoor.MSIL.FORMBOOK.TL0101E826ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Agent.ISV.gen!Eldorado
VBA32 malicious TScope.Trojan.MSIL
VIPRE malicious Trojan.GenericKD.79882602
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Agent.803336.A
Webroot malicious Win.Trojan.Gen
ZoneAlarm malicious Troj/Krypt-AWL

Details From VirusTotal

Basic Properties
MD5a2ec80bd4da144b4ba8a3ab9406483e4
SHA-1deac0e5592c710df4c8d813ca4c42e0227da5a9c
SHA-2560a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419
VHash285036755511c08237413021f
SSDEEP24576:HM8+v9OiUr6SpkXcFCINpBlKmGXU5DbNOf:av3UrhpkMo8flKDkQ
TLSHT12A0501B4AA2DCA02D8A543F80A61E73413F0AC9DF120D24B9EFDFCEB78B57552419647
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size784.5 KB
History
Creation date2069-03-24 03:39 UTC
First seen on VirusTotal2026-04-08 07:28 UTC
Last submission2026-05-08 12:51 UTC
Last analysis2026-05-25 06:31 UTC
Last modified on VirusTotal2026-06-03 17:49 UTC
Known Names
  • 0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419.exe
  • yvghxg.exe
  • _0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419.exe
  • Yeni_talep-pdf.bat

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 803336 bytes. Tags: AsyncRAT, exe. Reporter: adrian__luca. First seen: 2026-05-08 12:43:27.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • AsyncRAT, Software S1087 | MITRE ATT&CK®
    web:attack.mitre.org

    AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns. [1] [2] [3]

  • AsyncRAT New Forks Uncovered With New Features Ranging From Screamer to ...
    web:cybersecuritynews.com

    A comprehensive analysis of AsyncRAT's expanding ecosystem, revealing a labyrinthine network of malware variants that have evolved.

  • AsyncRAT Malware: A Dual Analysis Approach - Medium
    web:medium.com

    This report details the analysis of a malicious software sample identified as AsyncRAT , a sophisticated Remote Access Trojan (RAT). The malware was observed employing advanced techniques to ...

  • What is AsyncRAT Malware? Definition, How It Works & Detection
    web:www.anavem.com

    What is AsyncRAT Malware? AsyncRAT (Asynchronous Remote Access Trojan) is a sophisticated malware family that provides cybercriminals with comprehensive remote control capabilities over infected Windows systems.

  • Stealthy AsyncRAT malware attacks targets US ... - BleepingComputer
    web:www.bleepingcomputer.com

    A campaign delivering the AsyncRAT malware to select targets has been active for at least the past 11 months, using hundreds of unique loader samples and more than 100 domains.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background. A sophisticated strain of ...

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Trojan:Win64/AsyncRat threat description - microsoft.com
    web:www.microsoft.com

    Trojan:Win64/ AsyncRat is a standout as a versatile remote access trojan that first appeared on GitHub in 2019, positioned as a legitimate open-source remote management utility. However, records confirm that following its launch, it has been co-opted for illicit operations by threat actors, including entry-level cybercriminals and organized syndicates tied to ransomware efforts. It is built on ...

  • AsyncRAT: 12 Key Questions Answered - securityscientist.net
    web:www.securityscientist.net

    12 Questions and Answers About AsyncRAT (RAT) What Is AsyncRAT and Where Did It Come From? AsyncRAT is an open-source Remote Access Trojan written in C# and targeting the .NET framework. It was published on GitHub in 2019, originally framed as a legitimate remote administration tool. Within months, threat actors began repurposing it for malicious campaigns, making it one of the most widely ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.