s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba high

📛 Threat Title

AsyncRAT: Telegram Portable.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 114688 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-11 07:49:19.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain portable.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/portable.exe

IOC database

Type
domain
Value
portable.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/portable.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba

IOC database

Type
hash_sha256
Value
94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba

hash_sha1 7eafd3cf387792e0f0f8dc3b7111bc89e4a542b0 VT 58 / 75

IOC database

Type
hash_sha1
Value
7eafd3cf387792e0f0f8dc3b7111bc89e4a542b0
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 58 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.R358277
Alibaba malicious Backdoor:MSIL/AsyncRat.5735eb1c
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Generic.AsyncRAT.Marte.B.B6509009
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.BD6351D1
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/AsyncRat.E
BitDefender malicious Generic.AsyncRAT.Marte.B.B6509009
Bkav malicious W32.Malware.836AAAFC
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.B6509009 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Packed.sa
huorong malicious Backdoor/MSIL.DcRat.a
Ikarus malicious Trojan.MSIL.AsyncRAT
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
McAfeeD malicious Trojan:Win/Generic.BCX
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.B6509009
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhgtml
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!B5E3118A07A3
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!B5E3118A07A3
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EC26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Kryptik.DOD.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Generic.AsyncRAT.Marte.B.B6509009
VirIT malicious Trojan.Win32.MSIL_Heur.A
Xcitium malicious Malware@#uek65lx7sayl
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD5b5e3118a07a3fd122db41c7abafd257a
SHA-17eafd3cf387792e0f0f8dc3b7111bc89e4a542b0
SHA-25694a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba
VHash215036555511d08d2e1d104d
SSDEEP1536:eu/S1T1C12HwhXslZbpXSGB2edJmW7DB5NRlmMGCCl:eu/OT1C12o8lZbpTBHLd2l
TLSHT1B3B32109E919485DE82C0E7C6CF3A4560695BF37E508ABC90DDCF8CF6A33A860EC5759
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size112.0 KB
History
Creation date2026-05-10 18:31 UTC
First seen on VirusTotal2026-05-11 07:48 UTC
Last submission2026-05-11 15:21 UTC
Last analysis2026-05-25 06:01 UTC
Last modified on VirusTotal2026-06-03 17:45 UTC
Known Names
  • Telegram.exe
  • yl1xax1ft.exe
  • psql.exe
  • 94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba.exe
  • Telegram Portable.exe
  • TelegramPortable.exe
  • 8pgbvx.exe
hash_md5 b5e3118a07a3fd122db41c7abafd257a VT 58 / 75

IOC database

Type
hash_md5
Value
b5e3118a07a3fd122db41c7abafd257a
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 58 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.RL_Generic.R358277
Alibaba malicious Backdoor:MSIL/AsyncRat.5735eb1c
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Generic.AsyncRAT.Marte.B.B6509009
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.BD6351D1
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/AsyncRat.E
BitDefender malicious Generic.AsyncRAT.Marte.B.B6509009
Bkav malicious W32.Malware.836AAAFC
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.B6509009 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Packed.sa
huorong malicious Backdoor/MSIL.DcRat.a
Ikarus malicious Trojan.MSIL.AsyncRAT
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
McAfeeD malicious Trojan:Win/Generic.BCX
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.B6509009
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhgtml
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!B5E3118A07A3
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!B5E3118A07A3
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EC26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Kryptik.DOD.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Generic.AsyncRAT.Marte.B.B6509009
VirIT malicious Trojan.Win32.MSIL_Heur.A
Xcitium malicious Malware@#uek65lx7sayl
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD5b5e3118a07a3fd122db41c7abafd257a
SHA-17eafd3cf387792e0f0f8dc3b7111bc89e4a542b0
SHA-25694a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba
VHash215036555511d08d2e1d104d
SSDEEP1536:eu/S1T1C12HwhXslZbpXSGB2edJmW7DB5NRlmMGCCl:eu/OT1C12o8lZbpTBHLd2l
TLSHT1B3B32109E919485DE82C0E7C6CF3A4560695BF37E508ABC90DDCF8CF6A33A860EC5759
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size112.0 KB
History
Creation date2026-05-10 18:31 UTC
First seen on VirusTotal2026-05-11 07:48 UTC
Last submission2026-05-11 15:21 UTC
Last analysis2026-05-25 06:01 UTC
Last modified on VirusTotal2026-06-03 17:45 UTC
Known Names
  • Telegram.exe
  • yl1xax1ft.exe
  • psql.exe
  • 94a0fd7835576e648601a4f7238d78c8883097468b889244cef9f9bf6f6eaeba.exe
  • Telegram Portable.exe
  • TelegramPortable.exe
  • 8pgbvx.exe

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 114688 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-11 07:49:19.

Remediations (10)

  • AsyncRAT Malware Analysis, Overview by ANY.RUN
    web:any.run

    AsyncRAT is a remote access trojan that observes and administers infected machines. Follow live malware statistics of this downloader and get new reports, samples, IOCs, etc.

  • FirstWatch Threat Spotlight: Truly Asynchronous AsyncRAT
    web:community.netwitness.com

    The second request using Telegram API is a download request for a file named "wwst.exe" from a remote server with the IP address 149.154.167.220 over port 443. The file appears to be a binary executable file that is being downloaded by the malware.

  • AsyncRAT in Action: Fileless Malware Techniques and Analysis of a ...
    web:malware.news

    A recent incident culminated in the deployment of AsyncRAT , a powerful Remote Access Trojan (RAT), through a multi-stage fileless loader. In this blog, we share some of the key takeaways from this investigation. For an in-depth analysis and full list of identified indicators of compromise (IOCs), download the full report here.

  • Malware source code investigation: AsyncRAT - MSSP Research Lab
    web:mssplab.github.io

    AsyncRAT is a Remote Access Trojan (RAT) designed to remotely monitor and control infected systems. It is free, open-source, and often used by cybercriminals for malicious purposes, such as stealing sensitive information, installing more malware, or performing DDoS attacks.

  • Desert Dexter Targets 900 Victims Using Facebook Ads and Telegram ...
    web:thehackernews.com

    The script then establishes persistence on the system, gathers and exfiltrates system information to a Telegram bot, takes a screenshot, and ultimately launches the AsyncRAT payload by injecting it into the "aspnet_compiler.exe" executable.

  • AsyncRAT malware campaign observed in wild - Broadcom Inc.
    web:www.broadcom.com

    AsyncRAT , an open-source remote access tool available on GitHub since 2009, is commonly leveraged as a Remote Access Trojan, making it one of the most frequently used RATs. Its distinctive features encompass keylogging, exfiltration techniques, and acting as an initial access staging point for the delivery of the final payload.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Unmasking AsyncRAT Malware: In-depth Analysis & Prevention Tips | Infosec
    web:www.infosecinstitute.com

    AsyncRat is one of the most popular and open-source remote access trojans. This piece of malware has been used for the last few months by professionals and cybercriminals in their activities. The more decent malicious wave of AsyncRat can escape security defenses by using a specially crafted .bat loader like other trojans, including URSA.

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.