s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6 high

📛 Threat Title

AsyncRAT: cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 808448 bytes. Tags: AsyncRAT, exe. Reporter: adrian__luca. First seen: 2026-05-08 12:43:40.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
656 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6 VT 51 / 75

IOC database

Type
hash_sha256
Value
cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 51 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Malware/Win.Generic.C5867565
Alibaba malicious Backdoor:MSIL/Formbook.c1564a63
alibabacloud malicious Backdoor:MSIL/Formbook.AK!M3DGW
ALYac malicious Trojan.GenericKD.79882163
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWorm
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C2E7B3
Avast malicious Win32:MalwareX-gen [Cryp]
AVG malicious Win32:MalwareX-gen [Cryp]
BitDefender malicious Trojan.GenericKD.79882163
Bkav malicious W32.Malware.6B579FEC
CAT-QuickHeal malicious Worm.Generic
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DrWeb malicious Trojan.Inject6.34760
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.GenericKD.79882163 (B)
ESET-NOD32 malicious MSIL/Kryptik.APZM trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/Formbook.GWMJE!tr
GData malicious Trojan.GenericKD.79882163
Google malicious Detected
Ikarus malicious Trojan.MSIL.Inject
K7AntiVirus malicious Backdoor ( 005cddf21 )
K7GW malicious Backdoor ( 005cddf21 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.Formbook.m!c
Malwarebytes malicious Trojan.MalPack.GS
MaxSecure malicious Trojan.Malware.273046945.susgen
McAfeeD malicious Trojan:Win/GenericPack.BMP
Microsoft malicious Trojan:MSIL/Formbook.ABFL!MTB
MicroWorld-eScan malicious Trojan.GenericKD.79882163
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:yvSqi1+Ph9RoJVXYDyTFjQ)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious ACL/FormBook Backdoor
Sophos malicious Mal/Generic-S
Symantec malicious Scr.Malcode!gdn34
Tencent malicious Malware.Win32.Gencirc.14aceb6c
TrellixENS malicious ACL/FormBook Backdoor
TrendMicro malicious TROJ_GEN.R002C0DDA26
TrendMicro-HouseCall malicious TROJ_GEN.R002C0DDA26
Varist malicious W32/MSIL_Agent.JZL.gen!Eldorado
VIPRE malicious Trojan.GenericKD.79882163
VirIT malicious Trojan.Win32.PSWStealer.DOM
Webroot malicious Win.Malware.Gen
Yandex malicious Trojan.Igent.b6k5Oi.1

Details From VirusTotal

Basic Properties
MD5384abb3d0e838ede58a0d7d90045eb0d
SHA-1294dd97ad7d7de4b1506556ad643458f3b811c03
SHA-256cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6
VHash285036751511c082374130220
SSDEEP24576:v8+v91z4XstSIDmFiVqFlWLylIvESF3hu2Qo:Rvv4XstSIKFBs5vE8VQo
TLSHT1EE050114A629CA02D8E547F40A61E3B513B44CDDA921D3078FFEFDEB787AB0A3509653
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size789.5 KB
History
Creation date2091-09-23 19:26 UTC
First seen on VirusTotal2026-04-09 06:49 UTC
Last submission2026-04-09 06:49 UTC
Last analysis2026-05-10 07:06 UTC
Last modified on VirusTotal2026-05-19 00:56 UTC
Known Names
  • EnSJ.exe
  • cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6.exe
  • f4pm4.exe
hash_sha1 294dd97ad7d7de4b1506556ad643458f3b811c03 VT 51 / 75

IOC database

Type
hash_sha1
Value
294dd97ad7d7de4b1506556ad643458f3b811c03
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 51 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Malware/Win.Generic.C5867565
Alibaba malicious Backdoor:MSIL/Formbook.c1564a63
alibabacloud malicious Backdoor:MSIL/Formbook.AK!M3DGW
ALYac malicious Trojan.GenericKD.79882163
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWorm
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C2E7B3
Avast malicious Win32:MalwareX-gen [Cryp]
AVG malicious Win32:MalwareX-gen [Cryp]
BitDefender malicious Trojan.GenericKD.79882163
Bkav malicious W32.Malware.6B579FEC
CAT-QuickHeal malicious Worm.Generic
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DrWeb malicious Trojan.Inject6.34760
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.GenericKD.79882163 (B)
ESET-NOD32 malicious MSIL/Kryptik.APZM trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/Formbook.GWMJE!tr
GData malicious Trojan.GenericKD.79882163
Google malicious Detected
Ikarus malicious Trojan.MSIL.Inject
K7AntiVirus malicious Backdoor ( 005cddf21 )
K7GW malicious Backdoor ( 005cddf21 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.Formbook.m!c
Malwarebytes malicious Trojan.MalPack.GS
MaxSecure malicious Trojan.Malware.273046945.susgen
McAfeeD malicious Trojan:Win/GenericPack.BMP
Microsoft malicious Trojan:MSIL/Formbook.ABFL!MTB
MicroWorld-eScan malicious Trojan.GenericKD.79882163
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:yvSqi1+Ph9RoJVXYDyTFjQ)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious ACL/FormBook Backdoor
Sophos malicious Mal/Generic-S
Symantec malicious Scr.Malcode!gdn34
Tencent malicious Malware.Win32.Gencirc.14aceb6c
TrellixENS malicious ACL/FormBook Backdoor
TrendMicro malicious TROJ_GEN.R002C0DDA26
TrendMicro-HouseCall malicious TROJ_GEN.R002C0DDA26
Varist malicious W32/MSIL_Agent.JZL.gen!Eldorado
VIPRE malicious Trojan.GenericKD.79882163
VirIT malicious Trojan.Win32.PSWStealer.DOM
Webroot malicious Win.Malware.Gen
Yandex malicious Trojan.Igent.b6k5Oi.1

Details From VirusTotal

Basic Properties
MD5384abb3d0e838ede58a0d7d90045eb0d
SHA-1294dd97ad7d7de4b1506556ad643458f3b811c03
SHA-256cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6
VHash285036751511c082374130220
SSDEEP24576:v8+v91z4XstSIDmFiVqFlWLylIvESF3hu2Qo:Rvv4XstSIKFBs5vE8VQo
TLSHT1EE050114A629CA02D8E547F40A61E3B513B44CDDA921D3078FFEFDEB787AB0A3509653
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size789.5 KB
History
Creation date2091-09-23 19:26 UTC
First seen on VirusTotal2026-04-09 06:49 UTC
Last submission2026-04-09 06:49 UTC
Last analysis2026-05-10 07:06 UTC
Last modified on VirusTotal2026-05-19 00:56 UTC
Known Names
  • EnSJ.exe
  • cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6.exe
  • f4pm4.exe
hash_md5 384abb3d0e838ede58a0d7d90045eb0d VT 51 / 75

IOC database

Type
hash_md5
Value
384abb3d0e838ede58a0d7d90045eb0d
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 51 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Malware/Win.Generic.C5867565
Alibaba malicious Backdoor:MSIL/Formbook.c1564a63
alibabacloud malicious Backdoor:MSIL/Formbook.AK!M3DGW
ALYac malicious Trojan.GenericKD.79882163
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWorm
APEX malicious Malicious
Arcabit malicious Trojan.Generic.D4C2E7B3
Avast malicious Win32:MalwareX-gen [Cryp]
AVG malicious Win32:MalwareX-gen [Cryp]
BitDefender malicious Trojan.GenericKD.79882163
Bkav malicious W32.Malware.6B579FEC
CAT-QuickHeal malicious Worm.Generic
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DrWeb malicious Trojan.Inject6.34760
Elastic malicious malicious (high confidence)
Emsisoft malicious Trojan.GenericKD.79882163 (B)
ESET-NOD32 malicious MSIL/Kryptik.APZM trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/Formbook.GWMJE!tr
GData malicious Trojan.GenericKD.79882163
Google malicious Detected
Ikarus malicious Trojan.MSIL.Inject
K7AntiVirus malicious Backdoor ( 005cddf21 )
K7GW malicious Backdoor ( 005cddf21 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.Formbook.m!c
Malwarebytes malicious Trojan.MalPack.GS
MaxSecure malicious Trojan.Malware.273046945.susgen
McAfeeD malicious Trojan:Win/GenericPack.BMP
Microsoft malicious Trojan:MSIL/Formbook.ABFL!MTB
MicroWorld-eScan malicious Trojan.GenericKD.79882163
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:yvSqi1+Ph9RoJVXYDyTFjQ)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious ACL/FormBook Backdoor
Sophos malicious Mal/Generic-S
Symantec malicious Scr.Malcode!gdn34
Tencent malicious Malware.Win32.Gencirc.14aceb6c
TrellixENS malicious ACL/FormBook Backdoor
TrendMicro malicious TROJ_GEN.R002C0DDA26
TrendMicro-HouseCall malicious TROJ_GEN.R002C0DDA26
Varist malicious W32/MSIL_Agent.JZL.gen!Eldorado
VIPRE malicious Trojan.GenericKD.79882163
VirIT malicious Trojan.Win32.PSWStealer.DOM
Webroot malicious Win.Malware.Gen
Yandex malicious Trojan.Igent.b6k5Oi.1

Details From VirusTotal

Basic Properties
MD5384abb3d0e838ede58a0d7d90045eb0d
SHA-1294dd97ad7d7de4b1506556ad643458f3b811c03
SHA-256cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6
VHash285036751511c082374130220
SSDEEP24576:v8+v91z4XstSIDmFiVqFlWLylIvESF3hu2Qo:Rvv4XstSIKFBs5vE8VQo
TLSHT1EE050114A629CA02D8E547F40A61E3B513B44CDDA921D3078FFEFDEB787AB0A3509653
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size789.5 KB
History
Creation date2091-09-23 19:26 UTC
First seen on VirusTotal2026-04-09 06:49 UTC
Last submission2026-04-09 06:49 UTC
Last analysis2026-05-10 07:06 UTC
Last modified on VirusTotal2026-05-19 00:56 UTC
Known Names
  • EnSJ.exe
  • cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6.exe
  • f4pm4.exe

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 808448 bytes. Tags: AsyncRAT, exe. Reporter: adrian__luca. First seen: 2026-05-08 12:43:40.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • AsyncRAT - attackevals.github.io
    web:attackevals.github.io

    AsyncRAT is an open source Remote Administration tool maintained by Nyan Cat and leveraged by Blind Eagle in its campaigns 1,2. For the purposes of this emulation a fork of AsyncRAT was made so that documentation could be added and relevent code functions could be highlighted with comments relating to their use and CTI.

  • MalwareBazaar | AsyncRAT - abuse.ch
    web:bazaar.abuse.ch

    AsyncRAT malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as AsyncRAT . Database Entry

  • NYAN-x-CAT/AsyncRAT-C-Sharp - GitHub
    web:github.com

    Open-Source Remote Administration Tool For Windows C# (RAT) - NYAN-x-CAT/ AsyncRAT -C-Sharp

  • How to remove AsyncRat
    web:howtoremove.guide

    This article talks about a very harmful computer program called AsyncRat , which can get into your computer in sneaky ways.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background. A sophisticated strain of ...

  • Endpoint Security recent news | Dark Reading
    web:www.darkreading.com

    Explore the latest news and expert commentary on Endpoint Security, brought to you by the editors of Dark Reading

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Trojan:Win64/AsyncRat threat description - microsoft.com
    web:www.microsoft.com

    Trojan:Win64/ AsyncRat is a standout as a versatile remote access trojan that first appeared on GitHub in 2019, positioned as a legitimate open-source remote management utility. However, records confirm that following its launch, it has been co-opted for illicit operations by threat actors, including entry-level cybercriminals and organized syndicates tied to ransomware efforts. It is built on ...

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    AsyncRAT can be used to proliferate malware such as ransomware, trojans, and other malicious programs. Furthermore, it allows users to monitor computing activities, access and manage various files (including personal documents), and start/end processes.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.