AsyncRAT

Description

AsyncRAT is an open source remote administration tool that appeared on GitHub in 2019 and gives users encrypted remote control of Windows computers. Its module system supports keylogging, file transfer, remote desktop viewing, and payload downloads, and its free availability has made it one of the most abused RAT families. Cyberattackers deliver it through phishing emails, cracked software, and loaders, and they rely on its encrypted channels to blend command and control traffic into normal HTTPS.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

AsyncRatAsyncrat

MITRE ATT&CK techniques

20 techniques across 6 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1106Native API
T1204User Execution
- T1204.002Malicious File

TA0005 Stealth

T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1564Hide Artifacts
- T1564.003Hidden Window
T1622Debugger Evasion

TA0007 Discovery

T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1124System Time Discovery
T1680Local Storage Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture
T1125Video Capture

TA0011 Command and Control

T1090Proxy
- T1090.003Multi-hop Proxy
T1105Ingress Tool Transfer
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms

Associated groups

Associated campaigns

C0060Operation AkaiRyū

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Backdoor.AsyncRat	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Downloader.AsyncRat	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Downloader.AsyncRAT	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Dropper.AsyncRAT	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
ByteCode-MSIL.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Document-PDF.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Document-Word.Downloader.AsyncRAT	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Document-XML.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Email-MIME.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Gen:Variant.AsyncRAT.122	AV
Gen:Variant.AsyncRAT.13	AV
Gen:Variant.AsyncRAT.23	AV
Gen:Variant.AsyncRAT.3	AV
Gen:Variant.AsyncRAT.367	AV
Gen:Variant.AsyncRAT.368	AV
Gen:Variant.AsyncRAT.382	AV
Gen:Variant.AsyncRAT.391	AV
Generic.AsyncRAT.A.0FF31BBC	AV
Generic.AsyncRAT.B.27E8600C	AV
Generic.AsyncRAT.B.90FD7B5E	AV
IL:Trojan.AsyncRAT.1	AV
IL:Trojan.AsyncRAT.11	AV
IL:Trojan.AsyncRAT.12	AV
IL:Trojan.AsyncRAT.123	AV
IL:Trojan.AsyncRAT.128	AV
IL:Trojan.AsyncRAT.132	AV
IL:Trojan.AsyncRAT.16	AV
IL:Trojan.AsyncRAT.199	AV
IL:Trojan.AsyncRAT.220	AV
IL:Trojan.AsyncRAT.297	AV
IL:Trojan.AsyncRAT.32	AV
IL:Trojan.AsyncRAT.343	AV
IL:Trojan.AsyncRAT.416	AV
IL:Trojan.AsyncRAT.466	AV
IL:Trojan.AsyncRAT.475	AV
IL:Trojan.AsyncRAT.539	AV
IL:Trojan.AsyncRAT.AA	AV
JS:Trojan.AsyncRAT.225	AV
JS:Trojan.AsyncRAT.483	AV
Script-BAT.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
Script-BAT.Downloader.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-BAT.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-BAT.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-JS.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
Script-JS.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-JS.Downloader.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-JS.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-Macro.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-Macro.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-Macro.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-PowerShell.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
Script-PowerShell.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-PowerShell.Downloader.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-PowerShell.Dropper.AsyncRat	ATP Sandbox Adv. Heuristics
Script-PowerShell.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-Python.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-WScript.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
Script-WScript.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-WScript.Downloader.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-WScript.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Script.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Script.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Script.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Shortcut.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
Shortcut.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Shortcut.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Text.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Trojan.AsyncRAT.10	AV
Trojan.AsyncRAT.169	AV
Trojan.AsyncRAT.178	AV
Trojan.AsyncRAT.4	AV
Trojan.AsyncRAT.54	AV
Trojan.AsyncRAT.85	AV
Trojan.AsyncRAT.9	AV
Trojan.AsyncRAT.AG	AV
Trojan.AsyncRAT.R	AV
VB:Trojan.AsyncRAT.17	AV
VB:Trojan.AsyncRAT.AH	AV
Win32.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
Win32.Backdoor.AsyncRat	ATP Sandbox Adv. Heuristics
Win32.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Win32.Downloader.AsyncRat	ATP Sandbox Adv. Heuristics
Win32.Downloader.AsyncRAT	ATP Sandbox Adv. Heuristics
Win32.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Win32.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Asyncrat	ATP Sandbox Adv. Heuristics
Win64.Backdoor.AsyncRAT	ATP Sandbox Adv. Heuristics
Win64.Spyware.AsyncRAT	ATP Sandbox Adv. Heuristics
Win64.Trojan.AsyncRAT	ATP Sandbox Adv. Heuristics

Related blogs

XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed

Related families

PlugX InvisiMole QakBot Remcos Agent Tesla