s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c high

📛 Threat Title

AsyncRAT: kop.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 160768 bytes. Tags: AsyncRAT, botnet, c2, exe, trojan. Reporter: VTR. First seen: 2026-05-10 18:44:22.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain kop.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/kop.exe

IOC database

Type
domain
Value
kop.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/kop.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c

IOC database

Type
hash_sha256
Value
20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c

hash_sha1 92ac3b84d67138f1c98d3b6a9764263550f63dad VT 57 / 75

IOC database

Type
hash_sha1
Value
92ac3b84d67138f1c98d3b6a9764263550f63dad
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 57 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.Generic.C5161034
Alibaba malicious Trojan:MSIL/AsyncRat.f132b168
alibabacloud malicious Trojan[dropper]:MSIL/AsyncRat.AKUI3DGW
Antiy-AVL malicious Trojan[Ransom]/MSIL.Blocker
APEX malicious Malicious
Arcabit malicious Trojan.MSIL.Cassiopeia.4
Avast malicious Win32:MalwareX-gen [Drp]
AVG malicious Win32:MalwareX-gen [Drp]
Avira malicious TR/Dropper.Gen
BitDefender malicious Gen:Variant.MSIL.Cassiopeia.4
Bkav malicious W32.Malware.355122B
CAT-QuickHeal malicious Trojan.MSIL
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.MulDrop23.34226
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.MSIL.Cassiopeia.4 (B)
ESET-NOD32 malicious MSIL/TrojanDropper.Agent.FVC trojan
F-Secure malicious Trojan.TR/Dropper.Gen
Fortinet malicious MSIL/Agent.FVC!tr
GData malicious Gen:Variant.MSIL.Cassiopeia.4
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Agent.sa
huorong malicious VirTool/MSIL.Obfuscator.aak
Ikarus malicious Trojan-Dropper.MSIL.Agent
K7AntiVirus malicious Trojan ( 700000201 )
K7GW malicious Trojan ( 700000201 )
Kaspersky malicious HEUR:Trojan.MSIL.APosT.gen
Kingsoft malicious MSIL.Trojan.APosT.gen
Lionic malicious Trojan.Win32.AsyncRat.4!c
Malwarebytes malicious Backdoor.XClient.Generic
MaxSecure malicious Trojan.Malware.121218.susgen
McAfeeD malicious Real Protect-LS!8F8743131055
Microsoft malicious Trojan:MSIL/AsyncRat.ABJU!MTB
MicroWorld-eScan malicious Gen:Variant.MSIL.Cassiopeia.4
NANO-Antivirus malicious Trojan.Win32.Dropper.lekuxw
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:fXjpdXmTWjp+6Sgt20AEiQ)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Trojan-IBQ!8F8743131055
Sophos malicious Troj/Mdrop-JWQ
Symantec malicious Backdoor.ASync!gm
Tencent malicious Trojan.Msil.XWorm.16001311
Trapmine malicious malicious.high.ml.score
TrellixENS malicious GenericRXWO-XF!8F8743131055
TrendMicro malicious Backdoor.Win32.XWORM.YXGEDZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA1
Varist malicious W32/MSIL_Agent.ERT.gen!Eldorado
VBA32 malicious TScope.Trojan.MSIL
VIPRE malicious Gen:Variant.MSIL.Cassiopeia.4
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Agent.160768.JS
ZoneAlarm malicious Troj/Mdrop-JWQ

Details From VirusTotal

Basic Properties
MD58f8743131055e1e181f7d7c4ff527065
SHA-192ac3b84d67138f1c98d3b6a9764263550f63dad
SHA-25620da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c
VHash2150367515110071920021
SSDEEP3072:gKqV65eA/58HvPiWgA5TZ0rbU6MzuXDE478n0IuLG3qT:jq65j/58P6WgA5dkbLMzmf80IuL9
TLSHT15CF38A01E0E4AD0ACFCF623610F8DB059590B94EA1779188B9DB60E719FEBD4DCD32A5
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size157.0 KB
History
Creation date2026-05-04 03:39 UTC
First seen on VirusTotal2026-05-04 03:39 UTC
Last submission2026-05-13 18:55 UTC
Last analysis2026-05-13 18:55 UTC
Last modified on VirusTotal2026-06-18 20:07 UTC
Known Names
  • kop.exe
  • 20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c.exe
  • jqx2js6zo.exe
hash_md5 8f8743131055e1e181f7d7c4ff527065 VT 57 / 75

IOC database

Type
hash_md5
Value
8f8743131055e1e181f7d7c4ff527065
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 57 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.Generic.C5161034
Alibaba malicious Trojan:MSIL/AsyncRat.f132b168
alibabacloud malicious Trojan[dropper]:MSIL/AsyncRat.AKUI3DGW
Antiy-AVL malicious Trojan[Ransom]/MSIL.Blocker
APEX malicious Malicious
Arcabit malicious Trojan.MSIL.Cassiopeia.4
Avast malicious Win32:MalwareX-gen [Drp]
AVG malicious Win32:MalwareX-gen [Drp]
Avira malicious TR/Dropper.Gen
BitDefender malicious Gen:Variant.MSIL.Cassiopeia.4
Bkav malicious W32.Malware.355122B
CAT-QuickHeal malicious Trojan.MSIL
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.MulDrop23.34226
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.MSIL.Cassiopeia.4 (B)
ESET-NOD32 malicious MSIL/TrojanDropper.Agent.FVC trojan
F-Secure malicious Trojan.TR/Dropper.Gen
Fortinet malicious MSIL/Agent.FVC!tr
GData malicious Gen:Variant.MSIL.Cassiopeia.4
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Agent.sa
huorong malicious VirTool/MSIL.Obfuscator.aak
Ikarus malicious Trojan-Dropper.MSIL.Agent
K7AntiVirus malicious Trojan ( 700000201 )
K7GW malicious Trojan ( 700000201 )
Kaspersky malicious HEUR:Trojan.MSIL.APosT.gen
Kingsoft malicious MSIL.Trojan.APosT.gen
Lionic malicious Trojan.Win32.AsyncRat.4!c
Malwarebytes malicious Backdoor.XClient.Generic
MaxSecure malicious Trojan.Malware.121218.susgen
McAfeeD malicious Real Protect-LS!8F8743131055
Microsoft malicious Trojan:MSIL/AsyncRat.ABJU!MTB
MicroWorld-eScan malicious Gen:Variant.MSIL.Cassiopeia.4
NANO-Antivirus malicious Trojan.Win32.Dropper.lekuxw
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Malware.Obfus/MSIL@AI.96 (RDM.MSIL2:fXjpdXmTWjp+6Sgt20AEiQ)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Trojan-IBQ!8F8743131055
Sophos malicious Troj/Mdrop-JWQ
Symantec malicious Backdoor.ASync!gm
Tencent malicious Trojan.Msil.XWorm.16001311
Trapmine malicious malicious.high.ml.score
TrellixENS malicious GenericRXWO-XF!8F8743131055
TrendMicro malicious Backdoor.Win32.XWORM.YXGEDZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA1
Varist malicious W32/MSIL_Agent.ERT.gen!Eldorado
VBA32 malicious TScope.Trojan.MSIL
VIPRE malicious Gen:Variant.MSIL.Cassiopeia.4
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Agent.160768.JS
ZoneAlarm malicious Troj/Mdrop-JWQ

Details From VirusTotal

Basic Properties
MD58f8743131055e1e181f7d7c4ff527065
SHA-192ac3b84d67138f1c98d3b6a9764263550f63dad
SHA-25620da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c
VHash2150367515110071920021
SSDEEP3072:gKqV65eA/58HvPiWgA5TZ0rbU6MzuXDE478n0IuLG3qT:jq65j/58P6WgA5dkbLMzmf80IuL9
TLSHT15CF38A01E0E4AD0ACFCF623610F8DB059590B94EA1779188B9DB60E719FEBD4DCD32A5
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size157.0 KB
History
Creation date2026-05-04 03:39 UTC
First seen on VirusTotal2026-05-04 03:39 UTC
Last submission2026-05-13 18:55 UTC
Last analysis2026-05-13 18:55 UTC
Last modified on VirusTotal2026-06-03 17:46 UTC
Known Names
  • kop.exe
  • 20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c.exe
  • jqx2js6zo.exe

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 160768 bytes. Tags: AsyncRAT, botnet, c2, exe, trojan. Reporter: VTR. First seen: 2026-05-10 18:44:22.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • AsyncRAT Malware: A Dual Analysis Approach - Medium
    web:medium.com

    This report details the analysis of a malicious software sample identified as AsyncRAT , a sophisticated Remote Access Trojan (RAT). The malware was observed employing advanced techniques to ...

  • Stealthy AsyncRAT malware attacks targets US ... - BleepingComputer
    web:www.bleepingcomputer.com

    A campaign delivering the AsyncRAT malware to select targets has been active for at least the past 11 months, using hundreds of unique loader samples and more than 100 domains.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • AsyncRAT Malware Explained: Capabilities, Risks, and Detection
    web:www.cloudsek.com

    AsyncRAT is a remote access trojan designed to provide attackers with persistent, interactive control over compromised Windows systems. The malware allows remote command execution, file manipulation, and user activity monitoring after initial access has been established.

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • Trojan:Win64/AsyncRat threat description - microsoft.com
    web:www.microsoft.com

    Trojan:Win64/ AsyncRat is a standout as a versatile remote access trojan that first appeared on GitHub in 2019, positioned as a legitimate open-source remote management utility. However, records confirm that following its launch, it has been co-opted for illicit operations by threat actors, including entry-level cybercriminals and organized syndicates tied to ransomware efforts. It is built on ...

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

  • AsyncRAT: 12 Key Questions Answered - securityscientist.net
    web:www.securityscientist.net

    12 Questions and Answers About AsyncRAT (RAT) What Is AsyncRAT and Where Did It Come From? AsyncRAT is an open-source Remote Access Trojan written in C# and targeting the .NET framework. It was published on GitHub in 2019, originally framed as a legitimate remote administration tool. Within months, threat actors began repurposing it for malicious campaigns, making it one of the most widely ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.