s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-1fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82 high

📛 Threat Title

AsyncRAT: Discord.exe

Category: AsyncRAT First seen: Last updated:

Description

File type: exe. Size: 115200 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-10 17:36:03.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain discord.exe VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/discord.exe

IOC database

Type
domain
Value
discord.exe
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Extracted from Threat MB-1fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/discord.exe

hash_imphash f34d5f2d4577ed6d9ceec516c1f5a744

IOC database

Type
hash_imphash
Value
f34d5f2d4577ed6d9ceec516c1f5a744
First seen
Last seen
Attached to this threat
Appears in
650 threats
Description
imphash of URLhaus payload 61d424c2e3c5d8db…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 1fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82 VT 58 / 74

IOC database

Type
hash_sha256
Value
1fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
AsyncRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 58 of 74 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.ADH.C78592
Alibaba malicious Backdoor:MSIL/AsyncRat.a7bd5310
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericAD.RAT
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Trojan.AsyncRAT.AB
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/AsyncRat.E
BitDefender malicious Trojan.AsyncRAT.AB
Bkav malicious W32.Malware.91C39CE3
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Trojan.AsyncRAT.AB (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Google malicious Detected
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious malware.kb.c.991
Lionic malicious Trojan.Win32.AsyncRAT.4!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
MaxSecure malicious Trojan.Malware.300983.susgen
McAfeeD malicious Real Protect-LS!21FE3E10589F
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Trojan.AsyncRAT.AB
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhfeqr
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Skyhigh malicious Fareit-FZT!21FE3E10589F
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!21FE3E10589F
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EB26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Kryptik.DOD.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Trojan.AsyncRAT.AB
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.115200
Webroot malicious W32.Trojan.Gen
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD521fe3e10589f6abac8be95cd4d9e9c12
SHA-14d748d9d30762afff4cd92acc01f394188352d52
SHA-2561fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82
VHash215036551511d08d2e1d104d
SSDEEP1536:iuqOJTPNY72oKU9/bXXSbHQhATnZkdt9p:iuquTPNo2LU9/bXYUA6b9p
TLSHT1F6B37F0737988322E5AE0BF479B265FCC52FAD227AD7FB4A1C40315603336E65A115EB
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size112.5 KB
History
Creation date2026-05-08 13:36 UTC
First seen on VirusTotal2026-05-10 17:30 UTC
Last submission2026-05-10 17:40 UTC
Last analysis2026-06-18 19:09 UTC
Last modified on VirusTotal2026-06-19 04:30 UTC
Known Names
  • Setup.exe
  • 1fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82.exe
  • DiscordSetup.exe
  • Discord.exe
  • jt8a2cw.exe
hash_sha1 4d748d9d30762afff4cd92acc01f394188352d52 VT 56 / 75

IOC database

Type
hash_sha1
Value
4d748d9d30762afff4cd92acc01f394188352d52
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 56 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.ADH.C78592
Alibaba malicious Backdoor:MSIL/AsyncRat.a7bd5310
alibabacloud malicious Rat:Win/AsyncRAT.Stub
ALYac malicious Trojan.GenericAD.RAT
Antiy-AVL malicious Trojan[Backdoor]/MSIL.Crysan
APEX malicious Malicious
Arcabit malicious Generic.AsyncRAT.Marte.B.4F92D7A5
Avast malicious MSIL:AsyncRat-E [Pws]
AVG malicious MSIL:AsyncRat-E [Pws]
Avira malicious TR/AsyncRat.E
BitDefender malicious Generic.AsyncRAT.Marte.B.4F92D7A5
Bkav malicious W32.Malware.91C39CE3
CAT-QuickHeal malicious Backdoor.MsilFC.S13564499
ClamAV malicious Win.Packed.Razy-9625918-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.msil
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen9.56514
Elastic malicious Windows.Generic.Threat
Emsisoft malicious Generic.AsyncRAT.Marte.B.4F92D7A5 (B)
ESET-NOD32 malicious MSIL/AsyncRAT.A trojan
F-Secure malicious Trojan.TR/AsyncRat.E
Fortinet malicious MSIL/AsyncRAT.A!tr
GData malicious MSIL.Backdoor.DCRat.D
Gridinsoft malicious Trojan.Win32.Packed.sa
huorong malicious Backdoor/MSIL.DcRat.a
K7AntiVirus malicious Trojan ( 005678321 )
K7GW malicious Trojan ( 005678321 )
Kaspersky malicious HEUR:Backdoor.MSIL.Crysan.gen
Kingsoft malicious malware.kb.c.991
Lionic malicious Trojan.Win32.AsyncRAT.m!c
Malwarebytes malicious Generic.Trojan.MSIL.DDS
McAfeeD malicious Real Protect-LS!21FE3E10589F
Microsoft malicious Backdoor:MSIL/AsyncRat!atmn
MicroWorld-eScan malicious Generic.AsyncRAT.Marte.B.4F92D7A5
NANO-Antivirus malicious Trojan.Win32.AsyncRAT.lhfeqr
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Trojan.AntiVM!1.CF63 (CLASSIC)
Sangfor malicious Suspicious.Win32.Save.a
SentinelOne malicious Static AI - Malicious PE
Sophos malicious Troj/AsyncRat-B
Symantec malicious Backdoor.ASync!g2
Tencent malicious Trojan.Msil.Agent.zap
Trapmine malicious malicious.moderate.ml.score
TrellixENS malicious Fareit-FZT!21FE3E10589F
TrendMicro malicious Backdoor.MSIL.ASYNCRAT.TL0101EB26ZZ
TrendMicro-HouseCall malicious Trojan.Win32.VSX.PE04CA3
Varist malicious W32/MSIL_Kryptik.DOD.gen!Eldorado
VBA32 malicious OScope.Backdoor.MSIL.Crysan
VIPRE malicious Generic.AsyncRAT.Marte.B.4F92D7A5
VirIT malicious Trojan.Win32.MSIL_Heur.A
ViRobot malicious Trojan.Win.Z.Asyncrat.115200
Webroot malicious W32.Trojan.Gen
ZoneAlarm malicious Troj/AsyncRat-B

Details From VirusTotal

Basic Properties
MD521fe3e10589f6abac8be95cd4d9e9c12
SHA-14d748d9d30762afff4cd92acc01f394188352d52
SHA-2561fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82
VHash215036551511d08d2e1d104d
SSDEEP1536:iuqOJTPNY72oKU9/bXXSbHQhATnZkdt9p:iuquTPNo2LU9/bXYUA6b9p
TLSHT1F6B37F0737988322E5AE0BF479B265FCC52FAD227AD7FB4A1C40315603336E65A115EB
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
File size112.5 KB
History
Creation date2026-05-08 13:36 UTC
First seen on VirusTotal2026-05-10 17:30 UTC
Last submission2026-05-10 17:40 UTC
Last analysis2026-06-04 06:05 UTC
Last modified on VirusTotal2026-06-04 08:33 UTC
Known Names
  • Setup.exe
  • 1fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82.exe
  • DiscordSetup.exe
  • Discord.exe
  • jt8a2cw.exe
hash_md5 21fe3e10589f6abac8be95cd4d9e9c12 VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/21fe3e10589f6abac8be95cd4d9e9c12

IOC database

Type
hash_md5
Value
21fe3e10589f6abac8be95cd4d9e9c12
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/21fe3e10589f6abac8be95cd4d9e9c12

References (1)

  • MalwareBazaar sample page

    File type: exe. Size: 115200 bytes. Tags: AsyncRAT, c2, DCRat, exe, RAT, windows. Reporter: anonymous. First seen: 2026-05-10 17:36:03.

Remediations (10)

  • Expired Discord Invites Hijacked for Stealthy Malware Attacks
    web:cyberinsider.com

    Check Point Research has uncovered a sophisticated malware campaign exploiting Discord's invite system to redirect users to malicious servers, launching multi-stage infections that deploy AsyncRAT and a customized Skuld Stealer. The attackers hijack expired or deleted Discord invites using vanity link registration and leverage trusted platforms like GitHub, Bitbucket, Pastebin, and Discord ...

  • Hackers Abuse Discord Invite to Spread Malicious Links and Deliver AsyncRAT
    web:cyberpress.org

    Threat actors are exploiting Discord's trusted invite infrastructure to redirect users to malicious servers and deploy advanced malware, including the infamous AsyncRAT remote access trojan and Skuld stealer. This campaign leverages Discord's popularity among gamers, crypto communities, and developers, turning the platform's own features such as vanity invites and server boosts into ...

  • Hackers Hijacked Discord Invite to Inject Malicious Links That Deliver ...
    web:cybersecuritynews.com

    Hackers exploit expired Discord invite links to spread AsyncRAT and crypto-stealers, using fake servers and social engineering tactics.

  • PDF Threat Advisory - hivepro.com
    web:hivepro.com

    Attack: Cybercriminals are hijacking expired or deleted Discord invite links and turning them into traps that lead users into fake servers. Once inside, users are tricked into running a disguised "verification" that secretly installs malware. This stealthy attack downloads powerful remote access tools and info-stealers that swipe your browser passwords, Discord tokens, and even crypto ...

  • Discord Invites Are Leveraged in Malware Distribution
    web:www.centripetal.ai

    Threat actors are actively abusing a flaw in Discord's invite link system to deliver malware through hijacked or spoofed server invites. The campaign, uncovered in mid-2025 by multiple cybersecurity research teams, leverages expired or recycled Discord invite links and redirects users through silent redirection chains that lead to multi-stage malware payloads. These payloads include AsyncRAT ...

  • AsyncRAT Malware Explained: Remote Access Trojan Used in Cyberattacks
    web:www.checkpoint.com

    AsyncRAT is a family of malware commonly used in cyberattacks as a Remote Access Trojan (RAT), providing remote control to a victim's system. Once AsyncRAT malware infiltrates a system, attackers covertly execute commands, exfiltrate sensitive data, or monitor user activity in the background.

  • The Silent Redirect: A Deep Dive into Discord Invite ... - LinkedIn
    web:www.linkedin.com

    Conduct a thorough forensics and malware removal effort, utilizing up-to-date antivirus and EDR solutions to scan for and remove AsyncRAT and Skuld Stealer artifacts.

  • Think before you Click(Fix): Analyzing the ClickFix social engineering ...
    web:www.microsoft.com

    The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  • AsyncRAT Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    This script injects AsyncRAT , VenomRAT, or XWorm malware into legitimate processes like notepad.exe, allowing attackers to gain remote access and steal data. Update September 11, 2025 - new campaign spreading AsyncRAT has been discovered. It revealed vast improvements to the malware's infiltration process and anti-detection techniques.

  • UnpacMe Results ...
    web:www.unpac.me

    AsyncRAT is a Remote Access Trojan (RAT) written in .NET, designed for remote monitoring and control of infected systems. Its core capabilities include keylogging, remote desktop control, audio and video recording, password recovery, and data exfiltration. AsyncRAT employs various persistence techniques such as creating scheduled tasks and modifying registry keys to ensure it remains active on ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.