s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025 high

📛 Threat Title

AsyncRAT: Chrome.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 133120 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-10 20:33:39.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain chrome.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/chrome.exe

IOC database

Type
domain
Value
chrome.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/chrome.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025 VT 56 / 75

IOC database

Type
hash_sha256
Value
b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 56 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Win.AsyncRAT.R511399
Alibaba malicious Backdoor:MSIL/AsyncRAT.0d0de44d
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericAD.RAT
Antiy-AVL malicious Trojan[Backdoor]/MSIL.AsyncRAT
APEX malicious Malicious
Arcabit malicious Trojan.AsyncRAT.4
Avira malicious TR/AsyncRat.E
BitDefender malicious Trojan.AsyncRAT.4
Bkav malicious W32.Malware.9954BE8F
CAT-QuickHeal malicious Backdoor.MsilFC.S23227500
ClamAV malicious Win.Packed.Razy-9807129-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.asyncrat
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.AsyncRATNET.2
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Trojan.AsyncRAT.4 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.C
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Downloader.dd!ni
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Trojan.MSIL.Agent.gen
Kingsoft malicious MSIL.Backdoor.DcRat.gen
Lionic malicious Trojan.Win32.AsyncRAT.4!c
Malwarebytes malicious DCRat.Backdoor.Rat.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!0882916EF89E
Microsoft malicious Backdoor:MSIL/AsyncRAT.X!MTB
MicroWorld-eScan malicious Trojan.AsyncRAT.4
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.leijnn
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Backdoor.AsyncRAT!1.C3F4 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious GenericRXQL-LI!0882916EF89E
Sophos malicious Troj/AsyncRat-B
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Trojan.Msil.Agent.zan
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious GenericRXQL-LI!0882916EF89E
TrendMicro malicious Backdoor.Win32.DCRAT.YXGEJZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/Trojan.IML.gen!Eldorado
VBA32 malicious Trojan.MSIL.DarkCrystal.Heur
VIPRE malicious Trojan.AsyncRAT.4
VirIT malicious Trojan.Win32.GenusT.EXSR
ViRobot malicious Trojan.Win.Z.Asyncrat.133120.H
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD50882916ef89e007c813131d214f4c5f2
SHA-15748ec0cd59f07b11abe86e213393c31019ca3ca
SHA-256b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025
VHash215036551511f081e362010ae
SSDEEP1536:ylQz7VmWQYCSk1GbbwwqDuENGqAvKJYrkVclN:y+7VmWQs0Gbbw3uPgiWY
TLSHT101D3068026D48751D05C06B668AE79F006EDFD6E2101CDDF68F4F38A967B78FC61329A
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size130.0 KB
History
Creation date2026-05-08 13:47 UTC
First seen on VirusTotal2026-05-10 20:32 UTC
Last submission2026-05-10 20:34 UTC
Last analysis2026-06-05 06:05 UTC
Last modified on VirusTotal2026-06-05 17:59 UTC
Known Names
  • Chrome.exe
  • b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025.exe
  • chrome.exe
  • zz7ot6e.exe
hash_sha1 5748ec0cd59f07b11abe86e213393c31019ca3ca VT 52 / 75

IOC database

Type
hash_sha1
Value
5748ec0cd59f07b11abe86e213393c31019ca3ca
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 52 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Win.AsyncRAT.R511399
Alibaba malicious Backdoor:MSIL/AsyncRAT.0d0de44d
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericAD.RAT
Antiy-AVL malicious Trojan[Backdoor]/MSIL.AsyncRAT
APEX malicious Malicious
Arcabit malicious Trojan.AsyncRAT.4
Avira malicious TR/AsyncRat.E
BitDefender malicious Trojan.AsyncRAT.4
CAT-QuickHeal malicious Backdoor.MsilFC.S23227500
ClamAV malicious Win.Packed.Razy-9807129-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.asyncrat
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.AsyncRATNET.2
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Trojan.AsyncRAT.4 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.C
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Downloader.dd!ni
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Trojan.MSIL.Agent.gen
Kingsoft malicious MSIL.Backdoor.DcRat.gen
Lionic malicious Trojan.Win32.AsyncRAT.4!c
Malwarebytes malicious DCRat.Backdoor.Rat.DDS
McAfeeD malicious Real Protect-LS!0882916EF89E
Microsoft malicious Backdoor:MSIL/AsyncRAT.X!MTB
MicroWorld-eScan malicious Trojan.AsyncRAT.4
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.leijnn
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Backdoor.AsyncRAT!1.C3F4 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Sophos malicious Troj/AsyncRat-B
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Trojan.Msil.Agent.zan
Trapmine malicious malicious.moderate.ml.score
TrendMicro malicious Backdoor.Win32.DCRAT.YXGEJZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/Trojan.IML.gen!Eldorado
VBA32 malicious Trojan.MSIL.DarkCrystal.Heur
VIPRE malicious Trojan.AsyncRAT.4
VirIT malicious Trojan.Win32.GenusT.EXSR
ViRobot malicious Trojan.Win.Z.Asyncrat.133120.H
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD50882916ef89e007c813131d214f4c5f2
SHA-15748ec0cd59f07b11abe86e213393c31019ca3ca
SHA-256b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025
VHash215036551511f081e362010ae
SSDEEP1536:ylQz7VmWQYCSk1GbbwwqDuENGqAvKJYrkVclN:y+7VmWQs0Gbbw3uPgiWY
TLSHT101D3068026D48751D05C06B668AE79F006EDFD6E2101CDDF68F4F38A967B78FC61329A
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size130.0 KB
History
Creation date2026-05-08 13:47 UTC
First seen on VirusTotal2026-05-10 20:32 UTC
Last submission2026-05-10 20:34 UTC
Last analysis2026-06-13 05:41 UTC
Last modified on VirusTotal2026-06-19 02:49 UTC
Known Names
  • Chrome.exe
  • b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025.exe
  • chrome.exe
  • zz7ot6e.exe
hash_md5 0882916ef89e007c813131d214f4c5f2

IOC database

Type
hash_md5
Value
0882916ef89e007c813131d214f4c5f2
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 133120 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-10 20:33:39.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • AsyncRAT - attackevals.github.io
    web:attackevals.github.io

    AsyncRAT has a client and server written in C# and hosts a suite of capabilities. Of particular note in Blind Eagle Campaigns is the inclusion of functions that are capable of stealing cookies from the browser, keyloggers, and remote desktop interaction 3,4,5,6,7.

  • AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and ...
    web:hunt.io

    Research on AsyncRAT campaigns using trojanized ScreenConnect installers and open directories, exposing resilient attacker infrastructure and C2 tactics. Learn more.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • Think before you Click(Fix): Analyzing the ClickFix social engineering ...
    web:www.microsoft.com

    The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

  • Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and ...
    web:www.trendmicro.com

    The AsyncRAT campaign analyzed in this report demonstrates the increasing sophistication of threat actors in abusing legitimate services and open-source tools to evade detection and establish persistent remote access.

  • CVE-2026-2441 Mitigation Script - RCE due to Use After Free in Google ...
    web:www.vicarius.io

    ℹ️ This remediation script implements a non-patch containment workaround that immediately reduces exposure by: T erminating running chrome.exe processes to stop ongoing risk, and enforcing a system-wide execution block using Windows policy (HKLM ...

  • CVE-2025-2783 Impact, Exploitability, and Mitigation Steps | Wiz
    web:www.wiz.io

    Understand the critical aspects of CVE-2025-2783 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.