s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70 high

📛 Threat Title

AsyncRAT: COTIZACION LUMINA GROUP.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 672256 bytes. Tags: AsyncRAT, exe. Reporter: James_inthe_box. First seen: 2026-05-11 12:25:59.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain group.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/group.exe

IOC database

Type
domain
Value
group.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/group.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70 VT 50 / 75

IOC database

Type
hash_sha256
Value
190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 50 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.Generic.C5487932
Alibaba malicious Backdoor:MSIL/Kryptik.743caddf
alibabacloud malicious Backdoor:MSIL/Kepavll.Gen
ALYac malicious Trojan.MSIL.Basic.8.Gen
Antiy-AVL malicious Trojan/MSIL.Kryptik
APEX malicious Malicious
Arcabit malicious Trojan.MSIL.Basic.8.Gen
Avast malicious Win32:MalwareX-gen [Cryp]
AVG malicious Win32:MalwareX-gen [Cryp]
Avira malicious TR/W32.MalwareX
Bkav malicious W32.Malware.FD947532
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.MSIL.Basic.8.Gen (B)
ESET-NOD32 malicious MSIL/Kryptik.AQCS trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/Formbook.ALLB!tr
GData malicious Trojan.MSIL.Basic.8.Gen
Google malicious Detected
huorong malicious Trojan/MSIL.Injector.nj
K7AntiVirus malicious Trojan ( 006df68e1 )
K7GW malicious Trojan ( 006df68e1 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious malware.kb.c.990
Lionic malicious Trojan.Win32.Basic.m!c
Malwarebytes malicious Malware.AI.4212244675
MaxSecure malicious Trojan.Malware.684672603.susgen
McAfeeD malicious Trojan:Win/AgentTesla.NEN
Microsoft malicious Trojan:Win32/Kepavll!rfn
MicroWorld-eScan malicious Trojan.MSIL.Basic.8.Gen
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:ne5WKWGwpJ27shZRN7T7Zg)
Sangfor malicious Backdoor.Msil.Kryptik.Vd36
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious BehavesLike.Win32.Infected.jh
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Malware.Win32.Gencirc.10c47c28
TrellixENS malicious Artemis!781EFCDC420F
TrendMicro malicious Trojan.MSIL.BASIC.TL0101E726ZZ
Varist malicious W32/MSIL_Agent.KBG.gen!Eldorado
VBA32 malicious Malware-Cryptor.MSIL.AgentTesla.Heur
VIPRE malicious Trojan.MSIL.Basic.8.Gen
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Kryptik.672256.C
Yandex malicious Trojan.Igent.b6u0W4.3

Details From VirusTotal

Basic Properties
MD5781efcdc420fc0a5a8b7dca2fcff180a
SHA-1ef05dbb486bc4362b6d0d1e6666c331f9dd0059c
SHA-256190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70
VHash265036651513108b8965a850
SSDEEP12288:uWuiw8I71N5cL6pCfwnfRLH5ugthDBiwEfzuu:uWG8IT9hDBiBv
TLSHT1A2E47B055BC32F49C3694679D2672929A3B18481D232C32BBFE544DA4F437E5FA83E27
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size656.5 KB
History
Creation date2019-12-24 23:56 UTC
First seen on VirusTotal2026-05-06 15:07 UTC
Last submission2026-05-11 14:07 UTC
Last analysis2026-06-05 06:05 UTC
Last modified on VirusTotal2026-06-05 17:52 UTC
Known Names
  • tyttyydrsdygdfsf.exe
  • powerpoint.exe
  • 190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70.exe
  • COTIZACIONLUMINAGROUP.exe
  • COTIZACIÓN LUMINA GROUP.exe
  • SOLICITUD DE COTIZACIÓN.exe
  • fg2lwoaf.exe
hash_sha1 ef05dbb486bc4362b6d0d1e6666c331f9dd0059c

IOC database

Type
hash_sha1
Value
ef05dbb486bc4362b6d0d1e6666c331f9dd0059c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_md5 781efcdc420fc0a5a8b7dca2fcff180a

IOC database

Type
hash_md5
Value
781efcdc420fc0a5a8b7dca2fcff180a
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 672256 bytes. Tags: AsyncRAT, exe. Reporter: James_inthe_box. First seen: 2026-05-11 12:25:59.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • MalwareBazaar | AsyncRAT - abuse.ch
    web:bazaar.abuse.ch

    AsyncRAT malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as AsyncRAT . Database Entry

  • AsyncRAT, Possible Luma Stealer, and Ransomhub Ransomware
    web:blackpointcyber.com

    The Adversary Pursuit Group (APG) predicts that it is very likely that threat actors will continue to use AsyncRAT to exploit other Healthcare organizations over the next 12 months. Recommended remediations and mitigations : Employee security training Heuristics-based activity monitoring and remediation Password managers Scripting language controls

  • SEO Poisoning Campaign Uses Fake Popular Apps to Deliver AsyncRAT
    web:gbhackers.com

    SEO Poisoning Campaign Impersonates 25+ Popular Apps to Deliver AsyncRAT Since October 2025.An ongoing SEO poisoning campaign abuses search results to trick users into downloading trojanized installers for more than 25 popular applications, ultimately deploying the AsyncRAT remote access trojan. Active since at least October 2025, the operation uses a mix of fake download portals, weaponized ...

  • Trojanized ScreenConnect installers evolve, dropping multiple ... - Acronis
    web:www.acronis.com

    Figure 1: The complete infection chain of AsyncRAT Upon execution, the installer launches ScreenConnect.ClientSetup.exe, which once installed, connects the victim machine to the attackers' C2 server. As mentioned, these installers differ from previous attacks involving ScreenConnect in that they use a ClickOnce runner installer.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • Threat description search results - Microsoft Security Intelligence
    web:www.microsoft.com

    Trojan:MSIL/ AsyncRAT stands out as the primary Microsoft Intermediate Language (MSIL) variant of AsyncRAT , a versatile remote access trojan developed in C# and compiled to MSIL for launching within the .NET framework. First released on GitHub in 2019 as an open-source tool marketed for legitimate remote administration, this MSIL version has since been repurposed and weaponized by threat actors ...

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

  • Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and ...
    web:www.trendmicro.com

    The AsyncRAT campaign analyzed in this report demonstrates the increasing sophistication of threat actors in abusing legitimate services and open-source tools to evade detection and establish persistent remote access.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.