s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d high

📛 Threat Title

AsyncRAT: googe.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 81408 bytes. Tags: AsyncRAT, botnet, c2, exe, trojan. Reporter: VTR. First seen: 2026-05-11 10:44:30.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain googe.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/googe.exe

IOC database

Type
domain
Value
googe.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/googe.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
656 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d VT 60 / 75

IOC database

Type
hash_sha256
Value
31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.Genome.C6979
Alibaba malicious Backdoor:MSIL/AsyncRat.a9ed908d
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericKD.80133605
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C6BDE5
Avast malicious Win32:MalwareX-gen [Drp]
AVG malicious Win32:MalwareX-gen [Drp]
Avira malicious TR/Dropper.Gen
BitDefender malicious Trojan.GenericKD.80133605
Bkav malicious W32.Malware.3C59A362
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Trojan.Asyncrat
Emsisoft malicious Trojan.GenericKD.80133605 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/Dropper.Gen
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Trojan.PSE.16I8278
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Packed.sa
huorong malicious Backdoor/Crysan.a
Jiangmin malicious Backdoor.MSIL.gguk
K7AntiVirus malicious Trojan ( 005c228f1 )
K7GW malicious Trojan ( 005c228f1 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRat.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Trojan:Win/Generic.BCX
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Trojan.GenericKD.80133605
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhfyhv
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!938B22BEFA48
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!938B22BEFA48
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EC26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/Samas.B.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Trojan.GenericKD.80133605
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.81408.J
Xcitium malicious Malware@#22en3qw3t6p1v
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD5938b22befa487bce2e97e0d54da29fe5
SHA-1de639a79c5696282c048e8b2bf36b9e1e4a8c760
SHA-25631b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d
VHash284036555511c08c2e1d104d
SSDEEP1536:GujSEWT7aC2Nd9m3dC9mV6bT049v5lM6bpdNmRdKWnv4eupmRz/5Lheo+kyc2uMi:GujeT7aC2xmtC93bTnh5lM6lYCNyx
TLSHT1B9832BB8279D705AF3693AF448922140D1F7AD331913E51A2C7F35AA0632A97CD43BED
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size79.5 KB
History
Creation date2023-10-16 21:40 UTC
First seen on VirusTotal2026-05-11 10:45 UTC
Last submission2026-05-11 12:07 UTC
Last analysis2026-06-09 06:02 UTC
Last modified on VirusTotal2026-06-18 01:04 UTC
Known Names
  • Stub.exe
  • 31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d.exe
  • 2lsxpzxo.exe
  • _31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d.exe
  • googe.exe
  • jk2zjj.exe
hash_sha1 de639a79c5696282c048e8b2bf36b9e1e4a8c760 VT 60 / 75

IOC database

Type
hash_sha1
Value
de639a79c5696282c048e8b2bf36b9e1e4a8c760
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.Genome.C6979
Alibaba malicious Backdoor:MSIL/AsyncRat.a9ed908d
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericKD.80133605
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C6BDE5
Avast malicious Win32:MalwareX-gen [Drp]
AVG malicious Win32:MalwareX-gen [Drp]
Avira malicious TR/Dropper.Gen
BitDefender malicious Trojan.GenericKD.80133605
Bkav malicious W32.Malware.3C59A362
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Trojan.Asyncrat
Emsisoft malicious Trojan.GenericKD.80133605 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/Dropper.Gen
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Trojan.PSE.16I8278
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Packed.sa
huorong malicious Backdoor/Crysan.a
Jiangmin malicious Backdoor.MSIL.gguk
K7AntiVirus malicious Trojan ( 005c228f1 )
K7GW malicious Trojan ( 005c228f1 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRat.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Trojan:Win/Generic.BCX
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Trojan.GenericKD.80133605
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhfyhv
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!938B22BEFA48
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!938B22BEFA48
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EC26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/Samas.B.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Trojan.GenericKD.80133605
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.81408.J
Xcitium malicious Malware@#22en3qw3t6p1v
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD5938b22befa487bce2e97e0d54da29fe5
SHA-1de639a79c5696282c048e8b2bf36b9e1e4a8c760
SHA-25631b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d
VHash284036555511c08c2e1d104d
SSDEEP1536:GujSEWT7aC2Nd9m3dC9mV6bT049v5lM6bpdNmRdKWnv4eupmRz/5Lheo+kyc2uMi:GujeT7aC2xmtC93bTnh5lM6lYCNyx
TLSHT1B9832BB8279D705AF3693AF448922140D1F7AD331913E51A2C7F35AA0632A97CD43BED
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size79.5 KB
History
Creation date2023-10-16 21:40 UTC
First seen on VirusTotal2026-05-11 10:45 UTC
Last submission2026-05-11 12:07 UTC
Last analysis2026-06-09 06:02 UTC
Last modified on VirusTotal2026-06-18 01:04 UTC
Known Names
  • Stub.exe
  • 31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d.exe
  • 2lsxpzxo.exe
  • _31b5e6fa6ab3600ec3d7fa5812a872913934c4d74b6453f0f5189d829de9a79d.exe
  • googe.exe
  • jk2zjj.exe
hash_md5 938b22befa487bce2e97e0d54da29fe5 VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/938b22befa487bce2e97e0d54da29fe5

IOC database

Type
hash_md5
Value
938b22befa487bce2e97e0d54da29fe5
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/938b22befa487bce2e97e0d54da29fe5

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 81408 bytes. Tags: AsyncRAT, botnet, c2, exe, trojan. Reporter: VTR. First seen: 2026-05-11 10:44:30.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • Hackers Deliver Fileless AsyncRAT Using Clickfix Technique via Fake ...
    web:cybersecuritynews.com

    A fileless AsyncRAT campaign targets German users via fake CAPTCHA prompts, using ClickFix to run PowerShell and gain remote access.

  • AsyncRAT Malware: A Dual Analysis Approach - Medium
    web:medium.com

    This report details the analysis of a malicious software sample identified as AsyncRAT , a sophisticated Remote Access Trojan (RAT). The malware was observed employing advanced techniques to ...

  • Malware source code investigation: AsyncRAT - MSSP Research Lab
    web:mssplab.github.io

    AsyncRAT is a Remote Access Trojan (RAT) designed to remotely monitor and control infected systems. It is free, open-source, and often used by cybercriminals for malicious purposes, such as stealing sensitive information, installing more malware, or performing DDoS attacks.

  • Malware of the Day - AsyncRAT - Active Countermeasures
    web:www.activecountermeasures.com

    A pop-up upon launching the AsyncRAT server confirms that ports 6606, 7707, and 8808 are the default ports. After conducting further research using the search term " AsyncRAT malware", we discover an excellent article by McAfee that details a specific "chain of infection" instance related to AsyncRAT .

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background. A sophisticated strain of ...

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Unmasking AsyncRAT Malware: In-depth Analysis & Prevention Tips | Infosec
    web:www.infosecinstitute.com

    AsyncRat is one of the most popular and open-source remote access trojans. This piece of malware has been used for the last few months by professionals and cybercriminals in their activities. The more decent malicious wave of AsyncRat can escape security defenses by using a specially crafted .bat loader like other trojans, including URSA.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • Backdoor:Win32/Asyncrat threat description - Microsoft Security ...
    web:www.microsoft.com

    Backdoor:Win32/ Asyncrat is a generic detection of the client side of the remote access tool (RAT), AsyncRAT , which has been modified by the attacker to be used as a backdoor. Read the following blog for details: HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.