TF-1932777
high
📛 Threat Title
AsyncRAT: Domain that is used for botnet Command&control (C&C) as.wordz.sbs
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: AsyncRAT. Confidence: 75. First seen: 2026-09-25 10:00:29 UTC. Reporter: abuse_ch. Tags: asyncrat.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
as.wordz.sbs
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
as.wordz.sbs- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain that is used for botnet Command&control (C&C) attributed to AsyncRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: AsyncRAT. Confidence: 75. First seen: 2026-09-25 10:00:29 UTC. Reporter: abuse_ch. Tags: asyncrat.
Remediations (10)
-
web:blog.qualys.com
In this blog we describe the AsyncRAT C2 (command & control) Framework, which allows attackers to remotely monitor and control other computers over a secure encrypted link. We provide an overview of this threat, a technical analysis, and a method of detecting the malware using Qualys Multi-Vector EDR. What is AsyncRAT C2 Framework?
-
web:censys.com
The malware supports remote command execution, file transfer, keylogging, screen capture, and credential harvesting, typically communicating with command-and-control (C2) servers over a custom TCP protocol with traffic encrypted via SSL/TLS, often using self-signed certificates that may present CN=AsyncRAT Server.
-
web:censys.com
Overview AsyncRAT is a family of open-source Windows remote access trojans (RATs): an original codebase that has been forked repeatedly into dozens of descendant malware families. Its most prolific descendant, DCRAT (also known as DarkCrystal RAT), spawned a second generation of forks of its own. Censys searches on 16 June 2026 confirmed live command-and-control (C2) infrastructure for more ...
-
web:cyberint.com
Introduced in 2019, AsyncRAT is classified as a remote access trojan (RAT) that primarily functions as a tool for stealing credentials and loading various malware, including ransomware. This RAT boasts botnet capabilities and features a command and control (C2) interface, granting operators the ability to manipulate infected hosts from a remote location. Despite its official GitHub page ...
-
web:wazuh.com
AsyncRAT is an open source remote access tool that is commonly used by threat actors for file exfiltration and remote desktop control.
-
web:www.activecountermeasures.com
What is Malware of the Day? Lab Setup "Malware": AsyncRAT MITRE Tactics: TA0011 Command and Control , T1571 Non-Standard Port Traffic Type: TCP SSL Connection Type: Reverse TCP C2 Platform: AsyncRAT Origin of Sample: Active Countermeasures Lab Host Payload Delivery Method: EXE binary (C2 implant) Target Host/Victim: 192.168.100.136 (Windows 10 Enterprise x64) C2 Server: 172.208.51.75 ...
-
web:www.checkpoint.com
Introduction to AsyncRAT A shortening of "Asynchronous Remote Access Trojan," AsyncRAT is a popular malware family used by a range of threat actors to target Windows systems. Remote access trojans are a type of malware that enables attackers to remotely control infected computers. Once the system is compromised, the attacker can execute commands remotely and receive data to facilitate ...
-
web:www.fortinet.com
FortiGuard Labs analyzes a multi-stage malware campaign that uses fake AI-themed documents, hidden PowerShell scripts, AutoHotkey loaders, and process injection to deploy AsyncRAT and maintain remote access.
-
web:www.huntress.com
AsyncRAT is a remote access trojan that enables attackers to control victim systems, steal data, and monitor activity. It works by embedding itself into target machines, often via phishing emails, and communicating with a command-and-control server to execute malicious actions.
-
web:www.trendaisecurity.com
Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response Threat actors exploited Cloudflare's free-tier infrastructure and legitimate Python environments to deploy the AsyncRAT remote access trojan, demonstrating advanced evasion techniques that abuse trusted cloud services for malicious operations.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.