s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-364e7cc930ff193dcd65548699117331d76e9f754218c4030c8fcf314cda7180 high

📛 Threat Title

AsyncRAT: playgamesonlinetogether.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 56320 bytes. Tags: AsyncRAT, exe, RAT. Reporter: cleanabuseweb. First seen: 2026-05-10 16:53:00.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain playgamesonlinetogether.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/playgamesonlinetogether.exe

IOC database

Type
domain
Value
playgamesonlinetogether.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-364e7cc930ff193dcd65548699117331d76e9f754218c4030c8fcf314cda7180

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/playgamesonlinetogether.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 364e7cc930ff193dcd65548699117331d76e9f754218c4030c8fcf314cda7180 VT 51 / 75

IOC database

Type
hash_sha256
Value
364e7cc930ff193dcd65548699117331d76e9f754218c4030c8fcf314cda7180
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 51 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.C3546893
Alibaba malicious Backdoor:MSIL/AsyncRat.3cf888d8
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Gen:Variant.Application.msilheracles.2895
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Trojan.Application.msilheracles.DB4F
Avira malicious DR/W32.MalwareX
BitDefender malicious Gen:Variant.Application.msilheracles.2895
Bkav malicious W32.Malware.D7A5A37D
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.Application.msilheracles.2895 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Dropper.DR/W32.MalwareX
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Trojan.PSE.16I8278
Google malicious Detected
Gridinsoft malicious Backdoor.Win32.Fynloski.zv!n
huorong malicious Backdoor/Crysan.a
Jiangmin malicious Backdoor.MSIL.gguk
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!FC866701A8A7
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Gen:Variant.Application.msilheracles.2895
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious ACL/Pony Infostealer
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EB26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/Samas.B.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Gen:Variant.Application.msilheracles.2895
VirIT malicious Trojan.Win32.MSIL_Heur.A
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD5fc866701a8a70a24a4eed5303f66599c
SHA-16c9082fd573ee7ed2751b97edd01f7453149d361
SHA-256364e7cc930ff193dcd65548699117331d76e9f754218c4030c8fcf314cda7180
VHash254036557511c08c2e1d104d
SSDEEP1536:TuhuJTPOY2k7533YsPhJbfWMQcmslafVTzdaujnCa:TuhOTPOY2k75HYs5JbfW+Xa9Tz4ujnCa
TLSHT1B2433C0037E9C227F27E4F7899F22246867BB2277603D65E2CC4519B5A23FC685425FA
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size55.0 KB
History
Creation date2023-10-16 21:40 UTC
First seen on VirusTotal2026-05-10 16:49 UTC
Last submission2026-05-10 16:49 UTC
Last analysis2026-06-02 06:03 UTC
Last modified on VirusTotal2026-06-03 17:47 UTC
Known Names
  • playgamesonline
  • 364e7cc930ff193dcd65548699117331d76e9f754218c4030c8fcf314cda7180.exe
  • 414t64jo.exe
  • playgamesonlinetogether.exe
hash_sha1 6c9082fd573ee7ed2751b97edd01f7453149d361

IOC database

Type
hash_sha1
Value
6c9082fd573ee7ed2751b97edd01f7453149d361
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_md5 fc866701a8a70a24a4eed5303f66599c VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/fc866701a8a70a24a4eed5303f66599c

IOC database

Type
hash_md5
Value
fc866701a8a70a24a4eed5303f66599c
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/fc866701a8a70a24a4eed5303f66599c

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 56320 bytes. Tags: AsyncRAT, exe, RAT. Reporter: cleanabuseweb. First seen: 2026-05-10 16:53:00.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • AsyncRAT - attackevals.github.io
    web:attackevals.github.io

    AsyncRAT has a client and server written in C# and hosts a suite of capabilities. Of particular note in Blind Eagle Campaigns is the inclusion of functions that are capable of stealing cookies from the browser, keyloggers, and remote desktop interaction 3,4,5,6,7.

  • SEO Poisoning Campaign Impersonates 2025 Popular Apps To Spread AsyncRAT
    web:cyberpress.org

    An active SEO poisoning campaign has been uncovered that impersonates over 25 popular applications to spread the AsyncRAT malware.

  • SEO Poisoning Campaign Uses Fake Popular Apps to Deliver AsyncRAT
    web:gbhackers.com

    SEO Poisoning Campaign Impersonates 25+ Popular Apps to Deliver AsyncRAT Since October 2025.An ongoing SEO poisoning campaign abuses search results to trick users into downloading trojanized installers for more than 25 popular applications, ultimately deploying the AsyncRAT remote access trojan. Active since at least October 2025, the operation uses a mix of fake download portals, weaponized ...

  • NYAN-x-CAT/AsyncRAT-C-Sharp - GitHub
    web:github.com

    Open-Source Remote Administration Tool For Windows C# (RAT) - NYAN-x-CAT/ AsyncRAT -C-Sharp

  • AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and ...
    web:hunt.io

    Research on AsyncRAT campaigns using trojanized ScreenConnect installers and open directories, exposing resilient attacker infrastructure and C2 tactics. Learn more.

  • How do I fix "Remediation Incomplete" after stopping the threat removal ...
    web:learn.microsoft.com

    I understand you're seeing " Remediation Incomplete" after stopping the threat removal. Just to confirm, are you using Microsoft Defender? Since the scan was interrupted, the best step now is to run a Microsoft Defender Offline scan. This will restart your PC and scan before Windows loads, helping remove stubborn threats. To do this, go to:

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.