s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd high

📛 Threat Title

AsyncRAT: AU88APP.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 28672 bytes. Tags: AsyncRAT, c2, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-11 19:33:25.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain au88app.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/au88app.exe

IOC database

Type
domain
Value
au88app.exe
First seen
Last seen
Attached to this threat
Appears in
3 threats
Description
Extracted from Threat MB-42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/au88app.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd

IOC database

Type
hash_sha256
Value
42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd

hash_sha1 203500197cbf57b75f92f4b43affa42d8ccab336 VT 60 / 75

IOC database

Type
hash_sha1
Value
203500197cbf57b75f92f4b43affa42d8ccab336
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 60 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Win.FO.C4971742
Alibaba malicious Backdoor:MSIL/AsyncRAT.329fdddc
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Generic.AsyncRAT.Marte.B.BE78F367
Antiy-AVL malicious Trojan[Backdoor]/MSIL.AsyncRAT
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.BE78F367
Avast malicious Win32:MalwareX-gen [Rat]
AVG malicious Win32:MalwareX-gen [Rat]
Avira malicious TR/W32.MalwareX
BitDefender malicious Generic.AsyncRAT.Marte.B.BE78F367
Bkav malicious W32.Malware.DC718647
CAT-QuickHeal malicious Trojan.Marte
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.SiggenNET.11
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.BE78F367 (B)
ESET-NOD32 malicious MSIL/Agent.CYT trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
huorong malicious Backdoor/MSIL.DcRat.a
Ikarus malicious Trojan.MSIL.Agent
K7AntiVirus malicious Trojan ( 005c228f1 )
K7GW malicious Trojan ( 005c228f1 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Backdoor.AsyncRAT
MaxSecure malicious Trojan.Malware.248441918.susgen
McAfeeD malicious Real Protect-LS!E14419A10BA8
Microsoft malicious Backdoor:MSIL/AsyncRAT.AA!MTB
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.BE78F367
NANO-Antivirus malicious Trojan.Win32.Ric.lhfhat
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!E14419A10BA8
Sophos malicious Troj/AsyncRat-W
SUPERAntiSpyware malicious Backdoor.Bot/Variant
Symantec malicious Backdoor.ASync!gm
Tencent malicious Backdoor.Msil.Dcrat.16002822
TrellixENS malicious Fareit-FZT!E14419A10BA8
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EC26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Agent.KVW.gen!Eldorado
VBA32 malicious Trojan.MSIL.Autorave.Heur
VIPRE malicious Generic.AsyncRAT.Marte.B.BE78F367
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Backdoor.Win.Z.Asyncrat.28672.AQ
Webroot malicious Win.Trojan.Gen
Zillya malicious Trojan.Agent.Win32.4491966
ZoneAlarm malicious Troj/AsyncRat-W

Details From VirusTotal

Basic Properties
MD5e14419a10ba83418e130d6d812240c43
SHA-1203500197cbf57b75f92f4b43affa42d8ccab336
SHA-25642364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd
VHash224036555511608a2a1b104c
SSDEEP384:pvlewvRisR0z42hoy3Kh6h4fIyH9qbuUscC/QxnCJfJbndnjJ1b7uIBT+:pvljZ3G4wfK2wIb1xBibnxvuIBT+
TLSHT15CD22C0473E8C566E1FC47BB883396009775E55B4913DB6E1FC990AE2A23BCDCA14BE0
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size28.0 KB
History
Creation date2043-03-05 01:15 UTC
First seen on VirusTotal2026-05-11 19:35 UTC
Last submission2026-05-11 19:35 UTC
Last analysis2026-06-01 06:03 UTC
Last modified on VirusTotal2026-06-01 08:08 UTC
Known Names
  • AU88APP.exe
  • _42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd.exe
  • rcs3b7xt.exe
hash_md5 e14419a10ba83418e130d6d812240c43 VT 58 / 75

IOC database

Type
hash_md5
Value
e14419a10ba83418e130d6d812240c43
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 58 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Backdoor/Win.FO.C4971742
Alibaba malicious Backdoor:MSIL/AsyncRAT.329fdddc
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Generic.AsyncRAT.Marte.B.BE78F367
Antiy-AVL malicious Trojan[Backdoor]/MSIL.AsyncRAT
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.BE78F367
Avast malicious Win32:MalwareX-gen [Rat]
AVG malicious Win32:MalwareX-gen [Rat]
Avira malicious TR/W32.MalwareX
BitDefender malicious Generic.AsyncRAT.Marte.B.BE78F367
Bkav malicious W32.Malware.DC718647
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.SiggenNET.11
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.BE78F367 (B)
ESET-NOD32 malicious MSIL/Agent.CYT trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Agent.sa
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005c228f1 )
K7GW malicious Trojan ( 005c228f1 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious MSIL.Backdoor.Crysan.gen
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Backdoor.AsyncRAT
MaxSecure malicious Trojan.Malware.248441918.susgen
McAfeeD malicious Real Protect-LS!E14419A10BA8
Microsoft malicious Backdoor:MSIL/AsyncRAT.AA!MTB
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.BE78F367
NANO-Antivirus malicious Trojan.Win32.Ric.lhfhat
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!E14419A10BA8
Sophos malicious Troj/AsyncRat-W
SUPERAntiSpyware malicious Backdoor.Bot/Variant
Symantec malicious Backdoor.ASync!gm
Tencent malicious Backdoor.Msil.Dcrat.16002822
TrellixENS malicious Fareit-FZT!E14419A10BA8
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EC26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Agent.KVW.gen!Eldorado
VBA32 malicious Trojan.MSIL.Autorave.Heur
VIPRE malicious Generic.AsyncRAT.Marte.B.BE78F367
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Backdoor.Win.Z.Asyncrat.28672.AQ
Webroot malicious Win.Trojan.Gen
ZoneAlarm malicious Troj/AsyncRat-W

Details From VirusTotal

Basic Properties
MD5e14419a10ba83418e130d6d812240c43
SHA-1203500197cbf57b75f92f4b43affa42d8ccab336
SHA-25642364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd
VHash224036555511608a2a1b104c
SSDEEP384:pvlewvRisR0z42hoy3Kh6h4fIyH9qbuUscC/QxnCJfJbndnjJ1b7uIBT+:pvljZ3G4wfK2wIb1xBibnxvuIBT+
TLSHT15CD22C0473E8C566E1FC47BB883396009775E55B4913DB6E1FC990AE2A23BCDCA14BE0
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size28.0 KB
History
Creation date2043-03-05 01:15 UTC
First seen on VirusTotal2026-05-11 19:35 UTC
Last submission2026-05-11 19:35 UTC
Last analysis2026-06-05 06:04 UTC
Last modified on VirusTotal2026-06-05 08:08 UTC
Known Names
  • AU88APP.exe
  • _42364d1b17f20b54806f6de76aa89df1f9ebb7587a1cb1bd9ea75983fac0c4fd.exe
  • rcs3b7xt.exe

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 28672 bytes. Tags: AsyncRAT, c2, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-11 19:33:25.

Remediations (10)

  • Azorult Stealer, AsyncRAT, and Trojan Malware | SOC Incidents
    web:blackpointcyber.com

    Between August 21-28, 2024, Blackpoint's Security Operations Center (SOC) responded to 438 total incidents and partner saves across our monitored on-premises, Microsoft 365, and Google Workspace environments, with confirmed or likely threat actor use of: Trojan malware likely for persistence and deploying second-stage payloads; Azorult Stealer for information theft; and AsyncRAT for ...

  • AsyncRAT in Action: Fileless Malware Techniques and Analysis of a ...
    web:malware.news

    A recent incident culminated in the deployment of AsyncRAT , a powerful Remote Access Trojan (RAT), through a multi-stage fileless loader. In this blog, we share some of the key takeaways from this investigation. For an in-depth analysis and full list of identified indicators of compromise (IOCs), download the full report here.

  • AsyncRAT Malware: A Dual Analysis Approach - Medium
    web:medium.com

    This report details the analysis of a malicious software sample identified as AsyncRAT , a sophisticated Remote Access Trojan (RAT). The malware was observed employing advanced techniques to ...

  • The AsyncRAT Onslaught: How a Trojanized ScreenConnect Threatens Your ...
    web:undercodetesting.com

    7. Implementing Application Allow-Listing The most effective mitigation is to prevent unauthorized software, like the trojanized installer, from running in the first place. `Get-CimInstance -ClassName Win32_Service -Filter "Name='ScreenConnect'" | Invoke-CimMethod -MethodName StopService` Step-by-step guide: This is a remediation command.

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • AsyncRAT Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    AsyncRAT removal instructions Manually removing AsyncRAT involves identifying and terminating the malicious processes, deleting associated files, and cleaning altered registry keys. Using endpoint detection and response (EDR) solutions, such as Huntress, is strongly recommended for thorough remediation and prevention of reinfection.

  • Open the wrong "PDF" and attackers gain remote access to your PC
    web:www.malwarebytes.com

    Instead, Windows mounts a virtual drive that quietly installs AsyncRAT , a backdoor Trojan that allows attackers to remotely monitor and control your computer. It's a remote access tool, which means attackers gain remote hands‑on‑keyboard control, while traditional file‑based defenses see almost nothing suspicious on disk.

  • Trojan:Win64/AsyncRat threat description - microsoft.com
    web:www.microsoft.com

    Trojan:Win64/ AsyncRat is a standout as a versatile remote access trojan that first appeared on GitHub in 2019, positioned as a legitimate open-source remote management utility. However, records confirm that following its launch, it has been co-opted for illicit operations by threat actors, including entry-level cybercriminals and organized syndicates tied to ransomware efforts. It is built on ...

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

  • Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and ...
    web:www.trendmicro.com

    The AsyncRAT campaign analyzed in this report demonstrates the increasing sophistication of threat actors in abusing legitimate services and open-source tools to evade detection and establish persistent remote access.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.