s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-67fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03 high

📛 Threat Title

AsyncRAT: 67fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 37376 bytes. Tags: AsyncRAT, exe. Reporter: adrian__luca. First seen: 2026-05-08 13:12:47.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
656 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 67fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03 VT 60 / 75

IOC database

Type
hash_sha256
Value
67fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Win.AsyncRat.C5372433
Alibaba malicious Backdoor:MSIL/AsyncRAT.0d873d89
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Gen:Variant.Application.FCA.2996
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWormRAT
APEX malicious Malicious
Arcabit malicious Trojan.Application.FCA.DBB4
Avast malicious Win32:MalwareX-gen [Bd]
AVG malicious Win32:MalwareX-gen [Bd]
Avira malicious TR/Spy.Gen
BitDefender malicious Gen:Variant.Application.FCA.2996
Bkav malicious W32.Malware.29D6AA0D
CAT-QuickHeal malicious Trojan.GenericFC.S29960909
ClamAV malicious Win.Packed.njRAT-10002074-1
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.XWormNET.9
Elastic malicious Windows.Trojan.XWorm
Emsisoft malicious Gen:Variant.Application.FCA.2996 (B)
ESET-NOD32 malicious MSIL/XWorm.C trojan
F-Secure malicious Trojan.TR/Spy.Gen
Fortinet malicious MSIL/Dacic.E977!tr
GData malicious MSIL.Backdoor.XWorm.C
Google malicious Detected
huorong malicious Backdoor/MSIL.Agent.aw
Ikarus malicious Backdoor.MSIL.XWormRAT
K7AntiVirus malicious Trojan ( 005aa5f01 )
K7GW malicious Trojan ( 005aa5f01 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.XWorm.m!c
Malwarebytes malicious Backdoor.XWorm
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!AE5430B57AD3
Microsoft malicious Trojan:MSIL/AsyncRAT!atmn
MicroWorld-eScan malicious Gen:Variant.Application.FCA.2996
NANO-Antivirus malicious Trojan.Win32.Backdoor.ldxjwn
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Backdoor.XWorm!1.129F7 (CLASSIC)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Trojan-FWBP!AE5430B57AD3
Sophos malicious Mal/XWorm-A
Symantec malicious MSIL.XWorm!gen2
Tencent malicious Trojan.Msil.Xworm.16001415
Trapmine malicious malicious.high.ml.score
TrellixENS malicious Trojan-FXHN!AE5430B57AD3
TrendMicro malicious Backdoor.MSIL.XWORM.SMTPTEGNL
TrendMicro-HouseCall malicious Backdoor.MSIL.XWORM.SMTPTEGNL
Varist malicious W32/MSIL_Agent.JZY.gen!Eldorado
VBA32 malicious Backdoor.MSIL.XWorm.gen
VIPRE malicious Gen:Variant.Application.FCA.2996
VirIT malicious Trojan.Win32.MSIL_Heur.B
ViRobot malicious Trojan.Win.Z.Xwormrat.37376.E
Webroot malicious Win.Backdoor.Msil.Xworm
Zillya malicious Trojan.XWorm.Win32.16271
ZoneAlarm malicious Mal/XWorm-A

Details From VirusTotal

Basic Properties
MD5ae5430b57ad3127d3c1c97d5c6b1d7cd
SHA-1790db8c7e06722be0bad5edaa8ccf230404baa09
SHA-25667fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03
VHash23403655151170772c110020
SSDEEP768:V6KkDnV2jZgWSVOo+M1TnLV/Fn9SRK6TOMh237:Vfb8BltnLxFn9SRK6TOM0L
TLSHT16DF25C0837D54229DAFE7FF95AB366021770E5079A03DB4E0DD8895E6B27BC189007E6
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size36.5 KB
History
Creation date2026-04-14 05:54 UTC
First seen on VirusTotal2026-04-14 13:35 UTC
Last submission2026-04-29 01:27 UTC
Last analysis2026-05-18 17:03 UTC
Last modified on VirusTotal2026-05-18 19:04 UTC
Known Names
  • XWormClient DJ APRIL.exe
  • q7953.exe
hash_sha1 790db8c7e06722be0bad5edaa8ccf230404baa09 VT 60 / 75

IOC database

Type
hash_sha1
Value
790db8c7e06722be0bad5edaa8ccf230404baa09
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Win.AsyncRat.C5372433
Alibaba malicious Backdoor:MSIL/AsyncRAT.0d873d89
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Gen:Variant.Application.FCA.2996
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWormRAT
APEX malicious Malicious
Arcabit malicious Trojan.Application.FCA.DBB4
Avast malicious Win32:MalwareX-gen [Bd]
AVG malicious Win32:MalwareX-gen [Bd]
Avira malicious TR/Spy.Gen
BitDefender malicious Gen:Variant.Application.FCA.2996
Bkav malicious W32.Malware.29D6AA0D
CAT-QuickHeal malicious Trojan.GenericFC.S29960909
ClamAV malicious Win.Packed.njRAT-10002074-1
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.XWormNET.9
Elastic malicious Windows.Trojan.XWorm
Emsisoft malicious Gen:Variant.Application.FCA.2996 (B)
ESET-NOD32 malicious MSIL/XWorm.C trojan
F-Secure malicious Trojan.TR/Spy.Gen
Fortinet malicious MSIL/Dacic.E977!tr
GData malicious MSIL.Backdoor.XWorm.C
Google malicious Detected
huorong malicious Backdoor/MSIL.Agent.aw
Ikarus malicious Backdoor.MSIL.XWormRAT
K7AntiVirus malicious Trojan ( 005aa5f01 )
K7GW malicious Trojan ( 005aa5f01 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.XWorm.m!c
Malwarebytes malicious Backdoor.XWorm
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!AE5430B57AD3
Microsoft malicious Trojan:MSIL/AsyncRAT!atmn
MicroWorld-eScan malicious Gen:Variant.Application.FCA.2996
NANO-Antivirus malicious Trojan.Win32.Backdoor.ldxjwn
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Backdoor.XWorm!1.129F7 (CLASSIC)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Trojan-FWBP!AE5430B57AD3
Sophos malicious Mal/XWorm-A
Symantec malicious MSIL.XWorm!gen2
Tencent malicious Trojan.Msil.Xworm.16001415
Trapmine malicious malicious.high.ml.score
TrellixENS malicious Trojan-FXHN!AE5430B57AD3
TrendMicro malicious Backdoor.MSIL.XWORM.SMTPTEGNL
TrendMicro-HouseCall malicious Backdoor.MSIL.XWORM.SMTPTEGNL
Varist malicious W32/MSIL_Agent.JZY.gen!Eldorado
VBA32 malicious Backdoor.MSIL.XWorm.gen
VIPRE malicious Gen:Variant.Application.FCA.2996
VirIT malicious Trojan.Win32.MSIL_Heur.B
ViRobot malicious Trojan.Win.Z.Xwormrat.37376.E
Webroot malicious Win.Backdoor.Msil.Xworm
Zillya malicious Trojan.XWorm.Win32.16271
ZoneAlarm malicious Mal/XWorm-A

Details From VirusTotal

Basic Properties
MD5ae5430b57ad3127d3c1c97d5c6b1d7cd
SHA-1790db8c7e06722be0bad5edaa8ccf230404baa09
SHA-25667fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03
VHash23403655151170772c110020
SSDEEP768:V6KkDnV2jZgWSVOo+M1TnLV/Fn9SRK6TOMh237:Vfb8BltnLxFn9SRK6TOM0L
TLSHT16DF25C0837D54229DAFE7FF95AB366021770E5079A03DB4E0DD8895E6B27BC189007E6
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size36.5 KB
History
Creation date2026-04-14 05:54 UTC
First seen on VirusTotal2026-04-14 13:35 UTC
Last submission2026-04-29 01:27 UTC
Last analysis2026-05-18 17:03 UTC
Last modified on VirusTotal2026-06-18 06:59 UTC
Known Names
  • XWormClient DJ APRIL.exe
  • q7953.exe
hash_md5 ae5430b57ad3127d3c1c97d5c6b1d7cd VT 60 / 75

IOC database

Type
hash_md5
Value
ae5430b57ad3127d3c1c97d5c6b1d7cd
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Win.AsyncRat.C5372433
Alibaba malicious Backdoor:MSIL/AsyncRAT.0d873d89
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Gen:Variant.Application.FCA.2996
Antiy-AVL malicious Trojan[Backdoor]/MSIL.XWormRAT
APEX malicious Malicious
Arcabit malicious Trojan.Application.FCA.DBB4
Avast malicious Win32:MalwareX-gen [Bd]
AVG malicious Win32:MalwareX-gen [Bd]
Avira malicious TR/Spy.Gen
BitDefender malicious Gen:Variant.Application.FCA.2996
Bkav malicious W32.Malware.29D6AA0D
CAT-QuickHeal malicious Trojan.GenericFC.S29960909
ClamAV malicious Win.Packed.njRAT-10002074-1
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.XWormNET.9
Elastic malicious Windows.Trojan.XWorm
Emsisoft malicious Gen:Variant.Application.FCA.2996 (B)
ESET-NOD32 malicious MSIL/XWorm.C trojan
F-Secure malicious Trojan.TR/Spy.Gen
Fortinet malicious MSIL/Dacic.E977!tr
GData malicious MSIL.Backdoor.XWorm.C
Google malicious Detected
huorong malicious Backdoor/MSIL.Agent.aw
Ikarus malicious Backdoor.MSIL.XWormRAT
K7AntiVirus malicious Trojan ( 005aa5f01 )
K7GW malicious Trojan ( 005aa5f01 )
Kaspersky malicious HEUR:Backdoor.MSIL.XWorm.gen
Kingsoft malicious MSIL.Backdoor.XWorm.gen
Lionic malicious Trojan.Win32.XWorm.m!c
Malwarebytes malicious Backdoor.XWorm
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!AE5430B57AD3
Microsoft malicious Trojan:MSIL/AsyncRAT!atmn
MicroWorld-eScan malicious Gen:Variant.Application.FCA.2996
NANO-Antivirus malicious Trojan.Win32.Backdoor.ldxjwn
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Backdoor.XWorm!1.129F7 (CLASSIC)
Sangfor malicious Trojan.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Trojan-FWBP!AE5430B57AD3
Sophos malicious Mal/XWorm-A
Symantec malicious MSIL.XWorm!gen2
Tencent malicious Trojan.Msil.Xworm.16001415
Trapmine malicious malicious.high.ml.score
TrellixENS malicious Trojan-FXHN!AE5430B57AD3
TrendMicro malicious Backdoor.MSIL.XWORM.SMTPTEGNL
TrendMicro-HouseCall malicious Backdoor.MSIL.XWORM.SMTPTEGNL
Varist malicious W32/MSIL_Agent.JZY.gen!Eldorado
VBA32 malicious Backdoor.MSIL.XWorm.gen
VIPRE malicious Gen:Variant.Application.FCA.2996
VirIT malicious Trojan.Win32.MSIL_Heur.B
ViRobot malicious Trojan.Win.Z.Xwormrat.37376.E
Webroot malicious Win.Backdoor.Msil.Xworm
Zillya malicious Trojan.XWorm.Win32.16271
ZoneAlarm malicious Mal/XWorm-A

Details From VirusTotal

Basic Properties
MD5ae5430b57ad3127d3c1c97d5c6b1d7cd
SHA-1790db8c7e06722be0bad5edaa8ccf230404baa09
SHA-25667fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03
VHash23403655151170772c110020
SSDEEP768:V6KkDnV2jZgWSVOo+M1TnLV/Fn9SRK6TOMh237:Vfb8BltnLxFn9SRK6TOM0L
TLSHT16DF25C0837D54229DAFE7FF95AB366021770E5079A03DB4E0DD8895E6B27BC189007E6
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size36.5 KB
History
Creation date2026-04-14 05:54 UTC
First seen on VirusTotal2026-04-14 13:35 UTC
Last submission2026-04-29 01:27 UTC
Last analysis2026-05-18 17:03 UTC
Last modified on VirusTotal2026-06-05 17:51 UTC
Known Names
  • XWormClient DJ APRIL.exe
  • q7953.exe

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 37376 bytes. Tags: AsyncRAT, exe. Reporter: adrian__luca. First seen: 2026-05-08 13:12:47.

Remediations (8)

  • AsyncRAT, Software S1087 | MITRE ATT&CK®
    web:attack.mitre.org

    AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns. [1] [2] [3]

  • Stealthy AsyncRAT malware attacks targets US ... - BleepingComputer
    web:www.bleepingcomputer.com

    A campaign delivering the AsyncRAT malware to select targets has been active for at least the past 11 months, using hundreds of unique loader samples and more than 100 domains.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background. A sophisticated strain of ...

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Unmasking AsyncRAT New Infection Chain - McAfee Blog
    web:www.mcafee.com

    AsyncRAT , short for "Asynchronous Remote Access Trojan," is a sophisticated piece of malware designed to compromise the security of computer systems and steal sensitive information. What sets AsyncRAT apart from other malware strains is its stealthy nature, making it a formidable adversary in the world of cybersecurity.

  • Trojan:Win64/AsyncRat threat description - microsoft.com
    web:www.microsoft.com

    Trojan:Win64/ AsyncRat is a standout as a versatile remote access trojan that first appeared on GitHub in 2019, positioned as a legitimate open-source remote management utility. However, records confirm that following its launch, it has been co-opted for illicit operations by threat actors, including entry-level cybercriminals and organized syndicates tied to ransomware efforts. It is built on ...

  • AsyncRAT: 12 Key Questions Answered - securityscientist.net
    web:www.securityscientist.net

    12 Questions and Answers About AsyncRAT (RAT) What Is AsyncRAT and Where Did It Come From? AsyncRAT is an open-source Remote Access Trojan written in C# and targeting the .NET framework. It was published on GitHub in 2019, originally framed as a legitimate remote administration tool. Within months, threat actors began repurposing it for malicious campaigns, making it one of the most widely ...

  • Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and ...
    web:www.trendmicro.com

    The AsyncRAT campaign analyzed in this report demonstrates the increasing sophistication of threat actors in abusing legitimate services and open-source tools to evade detection and establish persistent remote access.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.