s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c high

📛 Threat Title

AsyncRAT: Telegram (2).exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 114688 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-10 15:11:30.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c VT 56 / 75

IOC database

Type
hash_sha256
Value
d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 56 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.R358277
Alibaba malicious Backdoor:MSIL/AsyncRat.c2fe27fb
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericAD.RAT
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.BEFD537
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/AsyncRat.E
BitDefender malicious Generic.AsyncRAT.Marte.B.BEF01335
Bkav malicious W32.Malware.8C2B0011
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.BEF01335 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Gridinsoft malicious Trojan.Win32.Packed.oa!s1
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!0B61849BD3A7
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.BEF01335
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhhviy
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!0B61849BD3A7
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!0B61849BD3A7
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EB26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Kryptik.DOD.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Generic.AsyncRAT.Marte.B.BEF01335
ViRobot malicious Trojan.Win.Z.Asyncrat.114688.C
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD50b61849bd3a7bb1d2ceb8c00403fda33
SHA-1fd5f5ae2862c93d35d3d82aa8767b87f9694a40c
SHA-256d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c
VHash215036555511d08d2e1d104d
SSDEEP1536:wu6YGpTPso25kBdUn3b1XSJc+Ed1mW7DB5NRlmMGCCz:wu6YGTPso2WBGn3b1h3d+z
TLSHT1ABB33049E919485DE82D0E7C6CF3A45606D5BF37E508ABC40CDCB8CFAA33A860EC5759
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size112.0 KB
History
Creation date2026-05-08 13:36 UTC
First seen on VirusTotal2026-05-10 15:08 UTC
Last submission2026-05-10 15:13 UTC
Last analysis2026-06-04 06:06 UTC
Last modified on VirusTotal2026-06-05 17:54 UTC
Known Names
  • Telegram.exe
  • d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c.exe
  • _d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c.exe
  • taj1g6df.exe
  • Telegram (2).exe
hash_sha1 fd5f5ae2862c93d35d3d82aa8767b87f9694a40c VT 58 / 75

IOC database

Type
hash_sha1
Value
fd5f5ae2862c93d35d3d82aa8767b87f9694a40c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 58 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.R358277
Alibaba malicious Backdoor:MSIL/AsyncRat.c2fe27fb
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericAD.RAT
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.BEFD537
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/AsyncRat.E
BitDefender malicious Generic.AsyncRAT.Marte.B.BEF01335
Bkav malicious W32.Malware.8C2B0011
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.asyncrat
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.BEF01335 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Packed.oa!s1
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!0B61849BD3A7
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.BEF01335
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhhviy
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!0B61849BD3A7
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!0B61849BD3A7
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EB26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Kryptik.DOD.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Generic.AsyncRAT.Marte.B.BEF01335
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.114688.C
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD50b61849bd3a7bb1d2ceb8c00403fda33
SHA-1fd5f5ae2862c93d35d3d82aa8767b87f9694a40c
SHA-256d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c
VHash215036555511d08d2e1d104d
SSDEEP1536:wu6YGpTPso25kBdUn3b1XSJc+Ed1mW7DB5NRlmMGCCz:wu6YGTPso2WBGn3b1h3d+z
TLSHT1ABB33049E919485DE82D0E7C6CF3A45606D5BF37E508ABC40CDCB8CFAA33A860EC5759
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size112.0 KB
History
Creation date2026-05-08 13:36 UTC
First seen on VirusTotal2026-05-10 15:08 UTC
Last submission2026-05-10 15:13 UTC
Last analysis2026-06-09 06:06 UTC
Last modified on VirusTotal2026-06-15 05:35 UTC
Known Names
  • Telegram.exe
  • d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c.exe
  • _d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c.exe
  • taj1g6df.exe
  • Telegram (2).exe
hash_md5 0b61849bd3a7bb1d2ceb8c00403fda33 VT 56 / 75

IOC database

Type
hash_md5
Value
0b61849bd3a7bb1d2ceb8c00403fda33
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 56 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.R358277
Alibaba malicious Backdoor:MSIL/AsyncRat.c2fe27fb
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericAD.RAT
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.BEFD537
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/AsyncRat.E
BitDefender malicious Generic.AsyncRAT.Marte.B.BEF01335
Bkav malicious W32.Malware.8C2B0011
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.BEF01335 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Gridinsoft malicious Trojan.Win32.Packed.oa!s1
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!0B61849BD3A7
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.BEF01335
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhhviy
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!0B61849BD3A7
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!0B61849BD3A7
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EB26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Kryptik.DOD.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Generic.AsyncRAT.Marte.B.BEF01335
ViRobot malicious Trojan.Win.Z.Asyncrat.114688.C
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD50b61849bd3a7bb1d2ceb8c00403fda33
SHA-1fd5f5ae2862c93d35d3d82aa8767b87f9694a40c
SHA-256d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c
VHash215036555511d08d2e1d104d
SSDEEP1536:wu6YGpTPso25kBdUn3b1XSJc+Ed1mW7DB5NRlmMGCCz:wu6YGTPso2WBGn3b1h3d+z
TLSHT1ABB33049E919485DE82D0E7C6CF3A45606D5BF37E508ABC40CDCB8CFAA33A860EC5759
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size112.0 KB
History
Creation date2026-05-08 13:36 UTC
First seen on VirusTotal2026-05-10 15:08 UTC
Last submission2026-05-10 15:13 UTC
Last analysis2026-06-04 06:06 UTC
Last modified on VirusTotal2026-06-04 08:34 UTC
Known Names
  • Telegram.exe
  • d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c.exe
  • _d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c.exe
  • taj1g6df.exe
  • Telegram (2).exe

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 114688 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-10 15:11:30.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • SYS01 Stealer, Ratty RAT, and AsyncRAT - Blackpoint Cyber
    web:blackpointcyber.com

    The scheduled tasks used rhc.exe, php.exe, and index.php to attempt persistent and continuous credential exfiltration; and The SYS01 stealer exfiltrated the affected user's stolen credentials via Telegram - installed the same day of the malicious activity.

  • FirstWatch Threat Spotlight: Truly Asynchronous AsyncRAT
    web:community.netwitness.com

    The second request using Telegram API is a download request for a file named "wwst.exe" from a remote server with the IP address 149.154.167.220 over port 443. The file appears to be a binary executable file that is being downloaded by the malware.

  • AsyncRAT Malware: A Dual Analysis Approach - Medium
    web:medium.com

    The most critical malicious process was GoogleUpdate.exe, which was flagged multiple times by ANY.RUN for network trojan activity and identified as AsyncRAT .

  • Malware of the Day - AsyncRAT - Active Countermeasures
    web:www.activecountermeasures.com

    A pop-up upon launching the AsyncRAT server confirms that ports 6606, 7707, and 8808 are the default ports. After conducting further research using the search term " AsyncRAT malware", we discover an excellent article by McAfee that details a specific "chain of infection" instance related to AsyncRAT .

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • Threat description search results - Microsoft Security Intelligence
    web:www.microsoft.com

    Trojan:MSIL/ AsyncRAT stands out as the primary Microsoft Intermediate Language (MSIL) variant of AsyncRAT , a versatile remote access trojan developed in C# and compiled to MSIL for launching within the .NET framework. First released on GitHub in 2019 as an open-source tool marketed for legitimate remote administration, this MSIL version has since been repurposed and weaponized by threat actors ...

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.