s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc high

📛 Threat Title

AsyncRAT: nacmayne.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 46080 bytes. Tags: AsyncRAT, botnet, c2, exe, trojan. Reporter: VTR. First seen: 2026-05-10 23:08:56.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain nacmayne.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/nacmayne.exe

IOC database

Type
domain
Value
nacmayne.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/nacmayne.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
655 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc

IOC database

Type
hash_sha256
Value
3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc

hash_sha1 e92bcf0d7f2ed18a78af57734e936e781d7fdd53 VT 59 / 75

IOC database

Type
hash_sha1
Value
e92bcf0d7f2ed18a78af57734e936e781d7fdd53
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 59 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.R358277
Alibaba malicious Backdoor:MSIL/AsyncRat.4f3e42db
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Generic.AsyncRAT.Marte.B.3592D5E2
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C66B2D
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/Dropper.Gen
BitDefender malicious Trojan.GenericKD.80112429
Bkav malicious W32.Malware.95FDCDB6
CAT-QuickHeal malicious Trojan.IgenericFC.S14890850
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Trojan.GenericKD.80112429 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/Dropper.Gen
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
huorong malicious Backdoor/MSIL.DcRat.a
Ikarus malicious Trojan.MSIL.AsyncRAT
Jiangmin malicious Backdoor.MSIL.gguk
K7AntiVirus malicious Trojan ( 005c228f1 )
K7GW malicious Trojan ( 005c228f1 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.4!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Trojan:Win/Generic.BCX
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Trojan.GenericKD.80112429
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!AF936B56E6F1
Sophos malicious Troj/AsyncRat-B
SUPERAntiSpyware malicious Trojan.Agent/Gen-Kryptik
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious suspicious.low.ml.score
TrellixENS malicious Fareit-FZT!AF936B56E6F1
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.SMXSR
TrendMicro-HouseCall malicious Backdoor.MSIL.ASYNCRAT.SMXSR
Varist malicious W32/Samas.B.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Trojan.GenericKD.80112429
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.46080.ESV
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD5af936b56e6f109e234bc06134041959d
SHA-1e92bcf0d7f2ed18a78af57734e936e781d7fdd53
SHA-2563941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc
VHash244036555511d08d2e1d104c
SSDEEP768:ZuoqdT1LxHaFzWUfbmBmo2qbNpL+Vl78tPIWzjbkgX3iuQXfvMZD8KLqoGBDZrx:ZuoqdT1LoG2CU3W3brXSuQP0ZtLOdrx
TLSHT16E231B003BE8863BF2BE4FB898F26145467AF2673603D54D2CC452DB5623BC696426FD
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size45.0 KB
History
Creation date2023-10-16 21:40 UTC
First seen on VirusTotal2026-04-14 09:47 UTC
Last submission2026-05-18 12:49 UTC
Last analysis2026-05-14 06:05 UTC
Last modified on VirusTotal2026-05-22 22:18 UTC
Known Names
  • Stub.exe
  • 3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc.exe
  • ditmemay.exe
  • t2bqa.exe
  • nacmayne.exe
  • 9hon3st59.exe
hash_md5 af936b56e6f109e234bc06134041959d VT 60 / 75

IOC database

Type
hash_md5
Value
af936b56e6f109e234bc06134041959d
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.R358277
Alibaba malicious Backdoor:MSIL/AsyncRat.4f3e42db
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericKD.80112429
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C66B2D
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/Dropper.Gen
BitDefender malicious Trojan.GenericKD.80112429
Bkav malicious W32.Malware.95FDCDB6
CAT-QuickHeal malicious Trojan.IgenericFC.S14890850
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Trojan.GenericKD.80112429 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/Dropper.Gen
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Agent.sa
huorong malicious Backdoor/MSIL.DcRat.a
Jiangmin malicious Backdoor.MSIL.gguk
K7AntiVirus malicious Trojan ( 005c228f1 )
K7GW malicious Trojan ( 005c228f1 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Trojan:Win/Generic.BCX
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Trojan.GenericKD.80112429
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lglnio
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!AF936B56E6F1
Sophos malicious Troj/AsyncRat-B
SUPERAntiSpyware malicious Trojan.Agent/Gen-Kryptik
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious suspicious.low.ml.score
TrellixENS malicious Fareit-FZT!AF936B56E6F1
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.SMXSR
TrendMicro-HouseCall malicious Backdoor.MSIL.ASYNCRAT.SMXSR
Varist malicious W32/Samas.B.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Trojan.GenericKD.80112429
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.46080.ESV
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD5af936b56e6f109e234bc06134041959d
SHA-1e92bcf0d7f2ed18a78af57734e936e781d7fdd53
SHA-2563941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc
VHash244036555511d08d2e1d104c
SSDEEP768:ZuoqdT1LxHaFzWUfbmBmo2qbNpL+Vl78tPIWzjbkgX3iuQXfvMZD8KLqoGBDZrx:ZuoqdT1LoG2CU3W3brXSuQP0ZtLOdrx
TLSHT16E231B003BE8863BF2BE4FB898F26145467AF2673603D54D2CC452DB5623BC696426FD
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size45.0 KB
History
Creation date2023-10-16 21:40 UTC
First seen on VirusTotal2026-04-14 09:47 UTC
Last submission2026-05-18 12:49 UTC
Last analysis2026-06-10 12:41 UTC
Last modified on VirusTotal2026-06-12 01:02 UTC
Known Names
  • Stub.exe
  • 3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc.exe
  • ditmemay.exe
  • t2bqa.exe
  • nacmayne.exe
  • 9hon3st59.exe

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 46080 bytes. Tags: AsyncRAT, botnet, c2, exe, trojan. Reporter: VTR. First seen: 2026-05-10 23:08:56.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • AsyncRAT - attackevals.github.io
    web:attackevals.github.io

    AsyncRAT is an open source Remote Administration tool maintained by Nyan Cat and leveraged by Blind Eagle in its campaigns 1,2. For the purposes of this emulation a fork of AsyncRAT was made so that documentation could be added and relevent code functions could be highlighted with comments relating to their use and CTI.

  • How to remove AsyncRat
    web:howtoremove.guide

    This article talks about a very harmful computer program called AsyncRat , which can get into your computer in sneaky ways.

  • AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and ...
    web:hunt.io

    Research on AsyncRAT campaigns using trojanized ScreenConnect installers and open directories, exposing resilient attacker infrastructure and C2 tactics. Learn more.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • Trojan:Win64/AsyncRat threat description - microsoft.com
    web:www.microsoft.com

    Trojan:Win64/ AsyncRat is a .NET-based remote access trojan that provides threat actors with comprehensive control. The infection begins through phishing campaigns distributing malicious HTML files or ISO images.

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

  • AsyncRAT Removal - Step-by-Step Guide (2026) | Yazoul Malware Tracker
    web:www.yazoul.net

    How to remove AsyncRAT malware. Step-by-step containment, removal, and verification. Covers persistence, dropped files, and post-removal hardening.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.

Domains scored
1 / 1
IPs scored
0 / 0
Flagged
1
IndicatorTypeVerdictScore
nacmayne.exe domain high 44