AsyncRAT

MITRE ATT&CK: S1087 View on attack.mitre.org

Aliases: AsyncRAT

Malware type
rat
Family
Malware family
Operating systems
windows
Related IoCs
102378 (95096 malicious)
Last IoC activity
2026-10-17 04:08:21
Profile updated
2026-07-07 12:53:17

Context

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.

Recent IoC activity

95,105 malicious indicators in Maltiverse are attributed to AsyncRAT (S1087). The 20 most recently updated:

TypeIndicatorUpdatedSources
IP address 3.141.210.37 2026-10-17 6
IP address 3.141.177.1 2026-10-17 6
IP address 3.127.253.86 2026-10-17 4
IP address 3.126.224.214 2026-10-17 4
IP address 3.121.139.82 2026-10-17 4
hostname pruevapoiu-20286.portmap.io 2026-10-17 2
hostname www.xoilac86c.cc 2026-10-17 1
hostname www.xoilac86z.cc 2026-10-17 1
hostname connect.servrweb.com 2026-10-17 2
hostname 100k5.ddns.net 2026-10-17 2
hostname rathost.hopto.org 2026-10-17 3
hostname bbnous.com 2026-10-17 1
hostname omahaclothingline.webredirect.org 2026-10-17 2
hostname barreroomdance.com 2026-10-17 1
hostname dnets.ddns.net 2026-10-17 3
hostname rvenom.duckdns.org 2026-10-17 1
hostname rahim321.duckdns.org 2026-10-17 3
hostname mydnshome.ddns.net 2026-10-17 1
hostname asyncspread.duckdns.org 2026-10-17 3
hostname bqm.uk.com 2026-10-17 1

Detection coverage

  • 3 YARA rules
  • 263 Sigma rules

Malware & tools used

  • Debugger Evasion (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Native API (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)
  • Multi-hop Proxy (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Dynamic Resolution (attack-pattern)
  • Hidden Window (attack-pattern)
  • System Checks (attack-pattern)
  • Video Capture (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Malicious File (attack-pattern)
  • Process Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Screen Capture (attack-pattern)
  • Keylogging (attack-pattern)
  • Scheduled Task (attack-pattern)

Used by threat actors

  • Operation AkaiRyū (campaign)
  • WebDAV Malware Delivery Activity (campaign)
  • APT-C-36 (threat-actor)
  • TA2541 (threat-actor)

Detection rules

  • SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp (yara-rule)
  • SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1 (yara-rule)
  • SEKOIA_Rat_Win_Asyncrat (yara-rule)

Reports & references

  • decoded.avast.io — Outbreak Of Follina In Australia (report)
  • proofpoint.com — Charting Ta2541S Flight (report)
  • research.checkpoint.com — Dangeroussavanna Two Year Long Campaign Targets Financial Institutions In French Speaking Africa (report)
  • Trend Micro — New Apt Group Earth Berberoka Targets Gambling Websites With Old (report)
  • Trend Micro — Earth Berberoka Windows Iocs 2.Txt (report)
  • botconf.eu — Botconf2022 40 Lunghihorejsi (report)
  • Cisco Talos — Operation Layover How We Tracked Attack (report)
  • intezer.com — Intezer 2020 Go Malware Round Up (report)
  • assets.virustotal.com — 2021Trends (report)
  • intel471.com — China Cybercrime Undergrond Deepmix Tea Horse Road Great Firewall (report)
  • blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
  • mp.weixin.qq.com — J A12Sox0K5Toyfaegbv W (report)
  • spamhaus.org — Botnet Threat Update January To June 2025 (report)
  • info.spamhaus.com — Jul Dec%202024%20Botnet%20Threat%20Update (report)
  • spamhaus.org — Botnet Threat Update July To December 2025 (report)
  • info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)
  • huntress.com — Fake Browser Updates Lead To Boinc Volunteer Computing Software (report)
  • blog.checkpoint.com — November 2023S Most Wanted Malware New Asyncrat Campaign Discovered While Fakeupdates Re Entered The Top Ten After Brief Hiatus (report)
  • Trend Micro — Ssl Tls Technical Brief (report)
  • spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
  • cybersecurity.att.com — Asyncrat Loader Obfuscation Dgas Decoys And Govno (report)
  • Kaspersky — 99204 (report)
  • linkedin.com — Urn:Li:Activity:7137086303329783808 (report)
  • ciphertechsolutions.com — Roboski Global Recovery Automation (report)
  • securityintelligence.com — Roboski Global Recovery Automation (report)

External references