TF-1932774
high
📛 Threat Title
AsyncRAT: Domain that is used for botnet Command&control (C&C) as.viaqs.sbs
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: AsyncRAT. Confidence: 75. First seen: 2026-09-25 10:00:28 UTC. Reporter: abuse_ch. Tags: asyncrat.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
as.viaqs.sbs
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
as.viaqs.sbs- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to AsyncRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: AsyncRAT. Confidence: 75. First seen: 2026-09-25 10:00:28 UTC. Reporter: abuse_ch. Tags: asyncrat.
Remediations (10)
-
web:blog.qualys.com
In this blog we describe the AsyncRAT C2 (command & control) Framework, which allows attackers to remotely monitor and control other computers over a secure encrypted link. We provide an overview of this threat, a technical analysis, and a method of detecting the malware using Qualys Multi-Vector EDR. What is AsyncRAT C2 Framework?
-
web:censys.com
The malware supports remote command execution, file transfer, keylogging, screen capture, and credential harvesting, typically communicating with command-and-control (C2) servers over a custom TCP protocol with traffic encrypted via SSL/TLS, often using self-signed certificates that may present CN=AsyncRAT Server.
-
web:cyberint.com
Introduced in 2019, AsyncRAT is classified as a remote access trojan (RAT) that primarily functions as a tool for stealing credentials and loading various malware, including ransomware. This RAT boasts botnet capabilities and features a command and control (C2) interface, granting operators the ability to manipulate infected hosts from a remote location. Despite its official GitHub page ...
-
web:deepwiki.com
This document covers the analysis of ASyncRAT (Asynchronous Remote Access Tool) campaigns and the methodology for decrypting stage 2 payloads. It provides indicators of compromise (IOCs) from multiple observed campaigns and technical details for payload extraction and decryption.
-
web:wazuh.com
AsyncRAT is an open source remote access tool that is commonly used by threat actors for file exfiltration and remote desktop control.
-
web:www.activecountermeasures.com
What is Malware of the Day? Lab Setup "Malware": AsyncRAT MITRE Tactics: TA0011 Command and Control , T1571 Non-Standard Port Traffic Type: TCP SSL Connection Type: Reverse TCP C2 Platform: AsyncRAT Origin of Sample: Active Countermeasures Lab Host Payload Delivery Method: EXE binary (C2 implant) Target Host/Victim: 192.168.100.136 (Windows 10 Enterprise x64) C2 Server: 172.208.51.75 ...
-
web:www.checkpoint.com
Introduction to AsyncRAT A shortening of "Asynchronous Remote Access Trojan," AsyncRAT is a popular malware family used by a range of threat actors to target Windows systems. Remote access trojans are a type of malware that enables attackers to remotely control infected computers.
-
web:www.extrahop.com
AsyncRAT and AsyncRAT variants are open-source malware that are easily accessible to attackers. This malware infects systems through user interaction, such as clicking phishing links or malicious ads. After a device is compromised, an attacker can remotely control the device, move laterally, or deploy secondary payloads and exfiltrate sensitive business information from the victim.
-
web:www.huntress.com
AsyncRAT is a remote access trojan that enables attackers to control victim systems, steal data, and monitor activity. It works by embedding itself into target machines, often via phishing emails, and communicating with a command-and-control server to execute malicious actions.
-
web:www.microsoft.com
Communication with command-and-control (C2) servers occurs over custom TCP ports, using efficient serialization for data exfiltration and device reconnaissance. Its core functionality encompasses comprehensive surveillance and system manipulation, including keylogging, audio/video recording, file theft, and remote shell access.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.